https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-forwarder-remove-data-from-a/m-p/119431#M24837 <P>Sorry for writing a second answer, I couldn't see that your answer was still in moderation.</P> Tue, 21 Jul 2015 12:38:12 GMT jeffland 2015-07-21T12:38:12Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-forwarder-remove-data-from-a/m-p/119428#M24834 <P>I read somewhere this is possible, however I can't find where or how - looking for confirmation:</P> <P><STRONG>Essentially I have the below scenario:</STRONG><BR /> FileA is being monitored by ForwarderA for new data. When new data is added to FileA, then ForwarderA will send this data to IndexerA and confirm receipt. Once completed, I want ForwarderA to remove the data it has transmitted successfully from FileA.</P> <P>Does anyone know if this is possible and if so how one might go about doing this?</P> Tue, 14 Jul 2015 14:51:24 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-forwarder-remove-data-from-a/m-p/119428#M24834 LewisWheeler 2015-07-14T14:51:24Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-forwarder-remove-data-from-a/m-p/119429#M24835 <P>Yes this can be done, Batch Mode should be configured on the directory/file as per the below configuration:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf?utm_source=answers&amp;utm_medium=incontext&amp;utm_term=inputs.conf&amp;utm_campaign=refdoc">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf?utm_source=answers&amp;utm_medium=incontext&amp;utm_term=inputs.conf&amp;utm_campaign=refdoc</A></P> Tue, 21 Jul 2015 10:47:18 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-forwarder-remove-data-from-a/m-p/119429#M24835 LewisWheeler 2015-07-21T10:47:18Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-forwarder-remove-data-from-a/m-p/119430#M24836 <P>You use the <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories#Why_use_upload_or_batch.3F">batch</A> input method instead of a monitor to remove files after reading them.</P> Tue, 21 Jul 2015 11:27:10 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-forwarder-remove-data-from-a/m-p/119430#M24836 jeffland 2015-07-21T11:27:10Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-forwarder-remove-data-from-a/m-p/119431#M24837 <P>Sorry for writing a second answer, I couldn't see that your answer was still in moderation.</P> Tue, 21 Jul 2015 12:38:12 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-forwarder-remove-data-from-a/m-p/119431#M24837 jeffland 2015-07-21T12:38:12Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-forwarder-remove-data-from-a/m-p/119432#M24838 <P>No worries - I guessed that was the case</P> Tue, 21 Jul 2015 13:07:22 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-Splunk-forwarder-remove-data-from-a/m-p/119432#M24838 LewisWheeler 2015-07-21T13:07:22Z