I have a file in a folder that is being monitored by Splunk. Its contents have been indexed. If I move that file into a batch
input (read-and-delete), will the file be re-indexed, or will Splunk know it has already indexed this data already?
(The specific scenario is I am changing a folder from monitor://
to batch://
and need to know if I need to remove all the files first to avoid data duplication in Splunk.)
so long as the policy is set to move to the sinkhole, Splunk should eat the file again.
The input could look something like this:
[batch:///some/path/some_file]
move_policy = sinkhole
without the move_policy = sinkhole setting, it won't load the files destructively and will keep track of them.
Hope this helps!
so long as the policy is set to move to the sinkhole, Splunk should eat the file again.
The input could look something like this:
[batch:///some/path/some_file]
move_policy = sinkhole
without the move_policy = sinkhole setting, it won't load the files destructively and will keep track of them.
Hope this helps!
Confirmed - Splunk does no checking and will re-index the file.