what can be done to keep the past in the past?

[raomu]

Hello,

For the past couple of weeks, we’ve seen events from the past being recently indexed. I assume that these few of the boxes were just powered up, and because of the forwarding infrastructure, that these are “current” events?
what can be done to keep the past in the past?

Thanks.

[MousumiChowdhur]

Hi @raomu,

You can keep the configuration DATETIME_CONFIG = blank in props.conf instead of setting it to CURRENT or NONE that will consider the timestamp of the event.

For your reference https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Propsconf

Thanks. Let me know if that helps.

[MousumiChowdhur]

Hi, If you have used crcSalt = <SOURCE> from your inputs.conf then you should remove that if you your files get rotated after a certain time duration. Setting crcSalt in such case will cause re-indexing of your data.

Thanks!

[raomu]

Thanks for your reply, but here the issue is not related to re-indexing.

My bad, may be I should have put more information.

Example :

we have some server X , Y

and these 2 servers have log files with year old data.

I installed the fwd and start getting logs from these 2 machines. Now the issue is the logs which is already associated with old or last year time stamps when indexed In spunk will take current time.

example :

event 03/06/017 xyzzy .......... login attempt.

during the index time it will take the current time not the actual event time.

So do we have any way of these types of events already indexed we can setup the indexed time same as event time ?

[MousumiChowdhur]

Hi, do you have a single source from where data is coming or multiple sources?

[raomu]

single source.