Is it possible to get data for last 10 days if i install UF today on any endpoint/Server?
I would like to get data like resource utilization of a particular server/endpoint for last 10 days, I'm planning to install Splunk UF today. Can i get the data if i install UF today
Hi @rupeshn,
with Universal Forwarder, you can set the time limit of your ingestion with the parameter ignoreOlderThan = 10d
in inputs.conf of your Universal forwarders, as you can see at https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf .
Ciao.
Giuseppe