Comments and answers for "Splunk_TA_aws initial_scan_datetime not being honored" The latest comments and answers for the question "Splunk_TA_aws initial_scan_datetime not being honored" Answer by soumyasaha25 the initial_scan_datetime cannot be edited once the input is created, maybe you are facing challenges because of this. As per Splunk documentation: The add-on starts to collect data later than this time. If you leave this field empty, the default value is 90 days before the input is configured. **Note: Once the input is created, this value cannot be changed.** Can you try the following: delete/move the S3 bucket -> remove the stanza from your inputs.conf -> add your settings for initial_scan_datetime in the inputs.conf -> restart splunk services (config changes will only be capture after a restart) -> add the S3 bucket again in the monitored location. Do let me know if this works. Also, since its been a while that you have posted this question, you might have figured out a solution, in that case do let me know what had fixed this issue (even if it is an temporary solution). Mon, 18 Jun 2018 08:45:22 GMT soumyasaha25