topic batch stanza in inputs.conf with nullQueue not processing in Getting Data In

batch stanza in inputs.conf with nullQueue not processing

kenoski — Fri, 04 Mar 2016 22:24:03 GMT

Hi,

I have a batch stanza in my inputs.conf file of my application. I would like to use it to remove old files from the application that could be causing problems for the users. Here is an example:

[batch://C:\Program Files\Splunk\etc\apps\<myApp>\local\ui\views\Old_View_File.xml]
disabled = false
queue=nullQueue
move_policy=sinkhole

It appears that Splunk is noticing the requested input, due to the _internal DB log files, but the requested file is not being processed and removed.

Any suggestions?

Thx.

Re: batch stanza in inputs.conf with nullQueue not processing

somesoni2 — Fri, 04 Mar 2016 23:24:29 GMT

THe possible values of attribute queue in inputs.conf are parsingQueue|indexQueue. That's why it's not processing the file at all.

Instead of writing a batch input (and you need to setup a props/transforms on Heavy forwarder/Indexer to route the data to nullQueue) why don't you setup scheduler task on the server OR setup a scripted input with the script deleting you unwanted files.

Re: batch stanza in inputs.conf with nullQueue not processing

kenoski — Wed, 16 Mar 2016 20:13:24 GMT

I had a Splunk Support case open asking how to remove files, and they suggested the batch and inputs.conf file method with nullQueue......they just forgot to mention that I would need to to do the other modifications also.

I'll give the scripted input a try.

thx.