https://community.splunk.com/t5/Getting-Data-In/inputs-conf-using-batch-in-stanza/m-p/189012#M37676 <P>according to the description of "batch" in inputs.conf.spec , you should set move_policy = sinkhole .</P> <PRE><CODE>move_policy = sinkhole * IMPORTANT: This attribute/value pair is required. You *must* include "move_policy = sinkhole" when defining batch inputs. * This loads the file destructively. * Do not use the batch input type for files you do not want to consume destructively. * As long as this is set, Splunk won't keep track of indexed files. Without the "move_policy = sinkhole" setting, it won't load the files destructively and will keep a track of them. </CODE></PRE> Thu, 05 Jun 2014 10:00:47 GMT dmlee 2014-06-05T10:00:47Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-using-batch-in-stanza/m-p/189011#M37675 <P>If my forwarder's inputs.conf stanza line is set to batch instead of monitor, it will delete the file after it is indexed.</P> <P>Lets say my inputs.conf stanza is this</P> <PRE><CODE>[batch:///home/bleung/tutorialdata] disabled = false index = tutorial sourcetype = testing </CODE></PRE> <P>If the files there are deleted in that path and I put in a file there with the same data just different timestamps, will the forwarder still send data to the indexer?</P> <P>Scenario:<BR /> I scp a file to the forward server and is oneshot'ed. Next day I scp a file with same data just different timestamps. The indexer does not receive any data for that day.</P> <P>Splunk version 5+<BR /> Splunk forwarder version 5+</P> Wed, 04 Jun 2014 23:33:36 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-using-batch-in-stanza/m-p/189011#M37675 ben_leung 2014-06-04T23:33:36Z https://community.splunk.com/t5/Getting-Data-In/inputs-conf-using-batch-in-stanza/m-p/189012#M37676 <P>according to the description of "batch" in inputs.conf.spec , you should set move_policy = sinkhole .</P> <PRE><CODE>move_policy = sinkhole * IMPORTANT: This attribute/value pair is required. You *must* include "move_policy = sinkhole" when defining batch inputs. * This loads the file destructively. * Do not use the batch input type for files you do not want to consume destructively. * As long as this is set, Splunk won't keep track of indexed files. Without the "move_policy = sinkhole" setting, it won't load the files destructively and will keep a track of them. </CODE></PRE> Thu, 05 Jun 2014 10:00:47 GMT https://community.splunk.com/t5/Getting-Data-In/inputs-conf-using-batch-in-stanza/m-p/189012#M37676 dmlee 2014-06-05T10:00:47Z