Getting Data In

Can you make universal forwarders only ingest files older than X minutes?

ptoro
Explorer

Trying to ingest file ONLY older than 10 minutes. I know the universal forwarder can ignore files older than X but looking for the opposite.

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Any specific reason for this condition?

0 Karma

ryanoconnor
Builder

I don't believe this would be possible, nor do I know of a setting for it.

If you were ignoring anything older than 10 minutes, you would eventually start capturing data within that 10 minute window as time progressed forward. There would just be about a 10 minute delay on the data coming into your indexer.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...