Getting Data In

How to configure Splunk to only index data from a database from the last 30 days?

singhh4
Path Finder

I have a database that stores proxy info which I want to index. The problem is that there is way too much data and I don't want to index all of it. I would prefer to only index the last 30 days worth of info. I couldn't find anything when looking through the index setting besides setting a storage limit. If I can't find a way to limit the indexing time, then I will have to use storage limit. Please help!

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi singhh4,

If you're getting the data into Splunk using a inputs.conf , reading a database dump for example, you can add the ignoreOlderThan option to set the this limit. This causes the monitored input to stop checking files for updates if their modtime has passed this threshold.

If you're getting the data into Splunk using a database query, simply use the query to only return the last 30 days worth of data.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi singhh4,

If you're getting the data into Splunk using a inputs.conf , reading a database dump for example, you can add the ignoreOlderThan option to set the this limit. This causes the monitored input to stop checking files for updates if their modtime has passed this threshold.

If you're getting the data into Splunk using a database query, simply use the query to only return the last 30 days worth of data.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...