In which props.conf file should I change the MAX_DAYS_AGO setting?

[vibe2]

I'm trying to change the MAX_DAYS_AGO value in the props.conf file, but there are a lot of props.conf files so i'm not sure which one to change.

[splunkreal]

Hello, do you add MAX_DAYS_AGO on props.conf forwarder-side? Thanks.

[livehybrid · Accepted solution]

Hi,
You should make your changes in $SPLUNK_HOME/etc/system/local/props.conf
This will override the default value.
e.g.

[mySourceType]
MAX_DAYS_AGO = 3650 

I hope this helps.

[ddrillic]

It's a good idea to complement it with ignoreOlderThan = <num of days>d on the forwarder...