Getting Data In

Why isn't ancient entry ignored despite `ignoreOlderThan` config in inputs.conf ?

_dave_b
Communicator

Hello. We have a pesky entry from 80+ days ago that keeps appearing in our search results. We added the ignoreOlderThan setting to the $SPLUNK_HOME\etc\system\local\inputs.conf file, but the old entry continues to appear in the search results.

The stanza from the inputs.conf looks like this

[monitor://c:\Program Files\Microsoft\device\logs\*\MSDevice_MSCP*.txt]
disabled = false
sourcetype = MSDevice_MSCP-MS
ignoreOlderThan = 2d

For good measure, we also changed the inputs.conf file in the app's directory, to look like this:

[monitor://C:\Program Files\Microsoft\device\]
disabled = false
host = bes12
ignoreOlderThan = 48h

And the entry continues to get picked up. Is there any other way I can get Splunk to ignore this (and any other older) entry?
Is there another inputs.conf file that has higher precedence? Should we double up on the backslashes in the .conf files?

Thanks for your insights!

0 Karma
1 Solution

woodcock
Esteemed Legend

The ignoreolderthan setting is on forwarding, not on searching. Once the event is in, it is in until it FIFOs out.

View solution in original post

jplumsdaine22
Influencer

Glad you were able to figure out the time range in the search, but I fear you may be missing what is happening here. Read this first:
http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Howindexingworks

woodcock
Esteemed Legend

The ignoreolderthan setting is on forwarding, not on searching. Once the event is in, it is in until it FIFOs out.

_dave_b
Communicator

By adding earliest=-48h to the search criteria, we were able to exclude the old entries, thus solving the issue.

But I would still really like to know the "proper" way to edit the inputs.config file to avoid this issue in the future, and to increase flexibility.

0 Karma

jplumsdaine22
Influencer

I downvoted this post because op missed the point of why the event continued to show up in their search results

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...