Hi,
I was moving about 20 aws data inputs (s3 sources) from an EOL server to an aws ec2.
The ec2 was a clone and had the Splunk_TA_aws app on it.
When I started up the new ec2, I disabled the TA.
I configured the Log Start Date directly in the inputs.conf for all the data inputs (and restarted).
Then I enabled the TA and disabled each of the inputs with the WebUI.
I went 1 by 1 disabling the input on the old host and enabling the input on the new host.
Everything looked good but now my indexing is blowing up.
I set the Log Start Date to 7/1/2019 but it seems the new ec2 host is fetching data before that date, like its not obeying the configs.
Any help is appreciated, thank you.
