topic Re: Upload multiple pre-existing IIS files in Getting Data In

Upload multiple pre-existing IIS files

cprundeanu — Thu, 16 Jun 2011 17:58:48 GMT

Hello, I have historical IIS log files on my PC's "D" drive that I would like to input into Splunk. Per the documentation:

Use the batch input type in inputs.conf to load files once and destructively. By default, Splunk's batch processor is located in $SPLUNK_HOME/var/spool/splunk. If you move a file into this directory, Splunk indexes it and then deletes it.

Does "loading files destructively" mean that the files will be deleted from my computer after they are uploaded?

Thank you,

Re: Upload multiple pre-existing IIS files

gkanapathy — Thu, 16 Jun 2011 18:13:15 GMT

Yes. If you copy a file into the directory, it will be indexed, then deleted. You can copy it instead and the original won't be deleted.

Re: Upload multiple pre-existing IIS files

jbsplunk — Thu, 16 Jun 2011 18:15:09 GMT

Yes, that is exactly what would occur. That is why it says that Splunk will load the file and then delete it. So, you should probably copy the files from their original location into $SPLUNK_HOME/var/spool/splunk/, then you won't have any problems.