https://community.splunk.com/t5/Getting-Data-In/Why-after-enabling-Move-policy-data-is-still-there/m-p/585821#M103043 <P>The <FONT face="courier new,courier">move_policy</FONT> setting applies only to batch inputs.&nbsp; If the stanza is not a batch stanza then <FONT face="courier new,courier">move_policy</FONT> is ignored.</P> Sat, 19 Feb 2022 18:38:05 GMT richgalloway 2022-02-19T18:38:05Z https://community.splunk.com/t5/Getting-Data-In/Why-after-enabling-Move-policy-data-is-still-there/m-p/585794#M103038 <P>Even after enabling move_policy=sinkhole, why is data still in there, verified that the path included in the monitor is not included in batch stanza</P> Tue, 22 Feb 2022 15:30:02 GMT https://community.splunk.com/t5/Getting-Data-In/Why-after-enabling-Move-policy-data-is-still-there/m-p/585794#M103038 Vivek_1404 2022-02-22T15:30:02Z https://community.splunk.com/t5/Getting-Data-In/Why-after-enabling-Move-policy-data-is-still-there/m-p/585821#M103043 <P>The <FONT face="courier new,courier">move_policy</FONT> setting applies only to batch inputs.&nbsp; If the stanza is not a batch stanza then <FONT face="courier new,courier">move_policy</FONT> is ignored.</P> Sat, 19 Feb 2022 18:38:05 GMT https://community.splunk.com/t5/Getting-Data-In/Why-after-enabling-Move-policy-data-is-still-there/m-p/585821#M103043 richgalloway 2022-02-19T18:38:05Z