Security

ignoreOlderThan Invalid for batch input

ips_mandar
Builder

Does ignoreOlderThanstanza in inputs.conf is Invalid for batch input?
I am getting error as-"Invalid key in stanza"

[batch:\\D:\...\*.zip]
move_policy = sinkhole
index=abc
ignoreOlderThan = 72h
Tags (1)
0 Karma
1 Solution

solarboyz1
Builder

A batch input does destructive reads of the files, so its not expecting older files to be in that location.
Which is why ignoreOlderThan isn`t listed as a valid option for a batch input:

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Inputsconf#BATCH_.28.22Upload_a_file.22_in_...

View solution in original post

0 Karma

solarboyz1
Builder

A batch input does destructive reads of the files, so its not expecting older files to be in that location.
Which is why ignoreOlderThan isn`t listed as a valid option for a batch input:

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Inputsconf#BATCH_.28.22Upload_a_file.22_in_...

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...