https://community.splunk.com/t5/Getting-Data-In/What-are-some-best-practices-for-Splunk-universal-forwarder/m-p/623768#M107311 <P>My Splunk Forwarder inputs.conf looks like this:</P> <P>[batch://C:\Splunk\MyApi\Local\Api\*.json]<BR />index = myapi_local<BR />move_policy = sinkhole<BR />disabled = 0<BR />source = myapi<BR />sourcetype = Api</P> <P>&nbsp;</P> <P>My logging files are generating every second . Is that perhaps a little bit too excessive? What's the best practice in using the Forwarder?</P> <P>File name examples:</P> <P>MyAPI_2022-12-08 23-06-28.json</P> <P>MyAPI_2022-12-08 23-06-29.json</P> <P>...</P> <P>Thanks! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 08 Dec 2022 23:18:04 GMT gunnist 2022-12-08T23:18:04Z https://community.splunk.com/t5/Getting-Data-In/What-are-some-best-practices-for-Splunk-universal-forwarder/m-p/623768#M107311 <P>My Splunk Forwarder inputs.conf looks like this:</P> <P>[batch://C:\Splunk\MyApi\Local\Api\*.json]<BR />index = myapi_local<BR />move_policy = sinkhole<BR />disabled = 0<BR />source = myapi<BR />sourcetype = Api</P> <P>&nbsp;</P> <P>My logging files are generating every second . Is that perhaps a little bit too excessive? What's the best practice in using the Forwarder?</P> <P>File name examples:</P> <P>MyAPI_2022-12-08 23-06-28.json</P> <P>MyAPI_2022-12-08 23-06-29.json</P> <P>...</P> <P>Thanks! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 08 Dec 2022 23:18:04 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-some-best-practices-for-Splunk-universal-forwarder/m-p/623768#M107311 gunnist 2022-12-08T23:18:04Z