How to verify if ignoreOlderThan is working or not ?

[ram254481493]

Hi I have implemented ignoreOlderThan for 7 days , I want to verify it if its working or not ? Is their any query or any place in DMC where i can validate that its working ?

[mayurr98 · Accepted solution]

you can look for event timestamps:

if you are getting events older than 7 days so it's not working.

you could check

... | timechart span=1d count

If you have events older than 7 days before making this configuration then check for the count if it's increasing or it's constant.
that way you could determine if ignoreOlderThan is working or not.

[ram254481493]

thanks after making the change i will validate.

[mayurr98]

sure, let me know.

[ram254481493]

@mayurr98 hi i amde the change yesterday for ignore older than 14 days after implementing it i can see the data over 30 days coming and didnt see any effect of it my settings are below:
[WinEventLog://System]
disabled = false
start_from = oldest
current_only = 1
checkpointInterval = 5
index = wineventlog
renderXml=false
ignoreOlderThan = 14d

after adding these settings i run this query for 30 days |tstats count WHERE index=wineventlog by _time span=1d and i can see the data of 30 days not sure why its not working ?

[mayurr98]

Did you change these settings or it's a new input that you wrote?

was this input already there and then you added ignoreOlderThan ?

[ram254481493]

@mayur98 yes this input is already there and i just added ignoreolderthan and change the current_only = 0 to 1

[mayurr98]

Yeah, so the already indexed data won't get affected. this attribute only affects from the time you make the change.

[ram254481493]

ok got it , but is their any way that we can verify it that its working properly ?

[mayurr98]

yeah. so whatever is ingested will remain constant after this change. So for example, if x number events are already indexed then it won't increase. It will remain the same. you need to look at those numbers and see if they are changing or not.

[ram254481493]

sure thanks mayur i can see the change