https://community.splunk.com/t5/Getting-Data-In/Do-sinkholes-work-on-forwarders/m-p/10664#M390 <P>By "sinkhole", I assume you mean the ability to copy a file into <CODE>$SPLUNK_HOME/var/spool/splunk</CODE>, and have it indexed then automatically deleted by Splunk. Yes, it is enabled on both heavy (<CODE>SplunkForwarder</CODE>) and light (<CODE>SplunkLightForwarder</CODE>) forwarders.</P> Mon, 29 Mar 2010 22:57:16 GMT gkanapathy 2010-03-29T22:57:16Z https://community.splunk.com/t5/Getting-Data-In/Do-sinkholes-work-on-forwarders/m-p/10663#M389 <P>Does a sinkhole work on all types of forwarders?</P> Mon, 29 Mar 2010 22:37:27 GMT https://community.splunk.com/t5/Getting-Data-In/Do-sinkholes-work-on-forwarders/m-p/10663#M389 Michael_Wilde 2010-03-29T22:37:27Z https://community.splunk.com/t5/Getting-Data-In/Do-sinkholes-work-on-forwarders/m-p/10664#M390 <P>By "sinkhole", I assume you mean the ability to copy a file into <CODE>$SPLUNK_HOME/var/spool/splunk</CODE>, and have it indexed then automatically deleted by Splunk. Yes, it is enabled on both heavy (<CODE>SplunkForwarder</CODE>) and light (<CODE>SplunkLightForwarder</CODE>) forwarders.</P> Mon, 29 Mar 2010 22:57:16 GMT https://community.splunk.com/t5/Getting-Data-In/Do-sinkholes-work-on-forwarders/m-p/10664#M390 gkanapathy 2010-03-29T22:57:16Z