Adding Data Sources for Today

[rprasch]

I want to be able to only pull *.log files or *.txt files from a specific folder from log files for the current day only. I dont need past history or the previous day's logs.

I am trying to limit the amount of messages Splunk is getting to avoid License overages.

[richgalloway]

Once all the files are pulled in, Splunk will only read new files - those from today. You may go over your license quota for a day or two, but there's no penalty.

If you don't want to do that. you could set ignoreOlderThan = 1d in inputs.conf. Be careful, however, if Splunk is down for a day, it won't process skipped files when it restarts.