https://community.splunk.com/t5/Getting-Data-In/Move-indexed-file/m-p/198427#M39331 <P>I want to move to another folder!</P> <P>eg. \backup\logs\</P> Thu, 09 Jan 2014 14:26:09 GMT erick_costa 2014-01-09T14:26:09Z https://community.splunk.com/t5/Getting-Data-In/Move-indexed-file/m-p/198425#M39329 <P>How to do to move files indexed by splunk?</P> <P>[monitor:///var/log/teste/teste.log]</P> Wed, 08 Jan 2014 21:26:14 GMT https://community.splunk.com/t5/Getting-Data-In/Move-indexed-file/m-p/198425#M39329 erick_costa 2014-01-08T21:26:14Z https://community.splunk.com/t5/Getting-Data-In/Move-indexed-file/m-p/198426#M39330 <P>I assume your talking about the source log files?</P> <P>It all depends on what you are trying to do and how your logs are generated.<BR /> Are they rolling, appended to or created freshly each time? That would determine what sort of input you should be using.</P> <P>As you are using a monitor statement there are no parameters to do anything with the file once it has been read, it just <EM>monitors</EM> (ie. reads) the file for new events. It is a non-destructive process.</P> <P>If your looking to delete the file once it is read they you need to look at using a different type of input stanza that has a move_policy option such as batch ( <A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/admin/inputsconf">http://docs.splunk.com/Documentation/Splunk/6.0.1/admin/inputsconf</A> ). </P> <BLOCKQUOTE> <PRE><CODE>move_policy = sinkhole </CODE></PRE> <UL> <LI>IMPORTANT: This attribute/value pair is required. You <EM>must</EM> include "move_policy = sinkhole" when defining batch inputs.</LI> <LI>This loads the file destructively.<BR /></LI> <LI>Do not use the batch input type for files you do not want to consume destructively.</LI> <LI>As long as this is set, Splunk won't keep track of indexed files. Without the "move_policy = sinkhole" setting, it won't load the files destructively and will keep a track of them.</LI> </UL> </BLOCKQUOTE> <P>Normally you would use that for uniquely logs that are placed into your filesystem by another process ie. ftp-ed in etc etc.</P> Thu, 09 Jan 2014 02:54:46 GMT https://community.splunk.com/t5/Getting-Data-In/Move-indexed-file/m-p/198426#M39330 Lucas_K 2014-01-09T02:54:46Z https://community.splunk.com/t5/Getting-Data-In/Move-indexed-file/m-p/198427#M39331 <P>I want to move to another folder!</P> <P>eg. \backup\logs\</P> Thu, 09 Jan 2014 14:26:09 GMT https://community.splunk.com/t5/Getting-Data-In/Move-indexed-file/m-p/198427#M39331 erick_costa 2014-01-09T14:26:09Z https://community.splunk.com/t5/Getting-Data-In/Move-indexed-file/m-p/198428#M39332 <P>I want to move to another folder!</P> <P>eg. \backup\logs\</P> Thu, 09 Jan 2014 14:26:58 GMT https://community.splunk.com/t5/Getting-Data-In/Move-indexed-file/m-p/198428#M39332 erick_costa 2014-01-09T14:26:58Z