Hi all,
I'd like to move a batch input after reading. Except not to /dev/null.
The manual is pretty clear:
move_policy = sinkhole
* IMPORTANT: This setting is required. You *must* include
"move_policy = sinkhole" when you define batch inputs.
* This setting causes the input to load the file destructively.
* Do not use the 'batch' input type for files you do not want to delete after
indexing.
* The "move_policy" setting exists for historical reasons, but remains as an
explicit double check. As an administrator you must very explicitly declare
that you want the data in the monitored directory (and its sub-directories) to
be deleted after being read and indexed.
However, instead of removing, it would be so nice to move it to another location. Anyone knows if this is possible?
I believe sinkhole is the only supported property of move_policy
so in my opinion, no this is not possible. You could always script it by setting a daily cron schedule
I believe sinkhole is the only supported property of move_policy
so in my opinion, no this is not possible. You could always script it by setting a daily cron schedule
Correct. Splunk has no mechanism to move files around in the filesystem.