topic Re: How to delete data from syslog-ng after Splunk indexes it, and confirm the data is indexed before deletion? in Getting Data In

How to delete data from syslog-ng after Splunk indexes it, and confirm the data is indexed before deletion?

ckillg — Fri, 02 Oct 2015 00:49:05 GMT

Is there a way to have Splunk delete the data from a syslog-ng server after it indexes it? Would like to confirm that data is indexed before it gets deleted.

Re: How to delete data from syslog-ng after Splunk indexes it, and confirm the data is indexed before deletion?

MuS — Fri, 02 Oct 2015 00:53:18 GMT

Hi ckillg,

if you're looking at inputs.conf http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/Inputsconf there is the batch mode which will delete a file after it has been indexed by Splunk....but it has no confirmation method.

Hope this helps ...

cheers, MuS

Re: How to delete data from syslog-ng after Splunk indexes it, and confirm the data is indexed before deletion?

shtychkn — Fri, 02 Oct 2015 03:38:23 GMT

Hey ckillg,

You could also set log rotation in syslog-ng to delete logs after a few days.

https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/example-logrotate.html

good luck.