The largest setting I can make for MAX_DAYS_AGO according to the props.conf.spec is 10951 days.
Is there anything I can do if I have data prior to 1984?
You can just set it to -1.
MAX_DAYS_AGO = -1
The props.conf reference doesn't mention that, so I'm not sure if there's any caveat around this.
View solution in original post
When adding data, You may set at
"Set Source Type", section "Advanced"
Name = MAX_DAYS_AGO
Value = -1
If you know about
you might expect that
is the earliest date we can have in Splunk.
At least on Windows, indeed, the earliest date for Splunk is
and not 1970-01-01 and even not 1970-12-31
PS: ISO date format is easily recognized by the pattern
Field: Timestamp format