I would like to use the sinkwhole policy to tell splunk to index a folder.
Please see below. I need to send these lgos to a seperate index. How can I define the index here to be sent? Whats the syntax.
Also if I append the below to the input.conf is it correct? There are some other stanzas in the input.conf already.
In $SPLUNK_HOME/etc/system/local/inputs.conf
[batch://YOURPATHHERE]
move_policy = sinkhole
host=HHHH
followSymlink = false
This should do it -
[batch://YOURPATHHERE]
move_policy = sinkhole
host=HHHH
followSymlink = false
index=XXXXXX
Where XXXXXX is the name of the index where you want to send the data
can you confirm other part of my question. in the input.conf. can i just append this ?