Hi,
Will the UF ignore files that are older than a certain value? I am testing against some old files (january), and it doesn't appear to be picking them up.
This depends on how you defined your monitor stanza in your inputs.conf. By default ignoreOlderThan settings is disabled and recurisve settings is true
If your stanza is defined like such it will pick up all file in directory and sub-directories
[monitor:///var/log]
[monitor:///var/log]
ignoreOlderThan=3d
recurisve=false
Also use the btool to determine which settings are being applied by which apps or TAs.
i.e. ./splunk btool --debug inputs list
Additional Reading:
This depends on how you defined your monitor stanza in your inputs.conf. By default ignoreOlderThan settings is disabled and recurisve settings is true
If your stanza is defined like such it will pick up all file in directory and sub-directories
[monitor:///var/log]
[monitor:///var/log]
ignoreOlderThan=3d
recurisve=false
Also use the btool to determine which settings are being applied by which apps or TAs.
i.e. ./splunk btool --debug inputs list
Additional Reading: