Can move_policy actually move things?

renems — Mon, 24 Oct 2016 13:43:30 GMT

Hi all,

I'd like to move a batch input after reading. Except not to /dev/null.
The manual is pretty clear:

move_policy = sinkhole
* IMPORTANT: This setting is required. You *must* include
  "move_policy = sinkhole" when you define batch inputs.
* This setting causes the input to load the file destructively.
* Do not use the 'batch' input type for files you do not want to delete after
  indexing.
* The "move_policy" setting exists for historical reasons, but remains as an
  explicit double check.  As an administrator you must very explicitly declare
  that you want the data in the monitored directory (and its sub-directories) to
  be deleted after being read and indexed.

However, instead of removing, it would be so nice to move it to another location. Anyone knows if this is possible?

Re: Can move_policy actually move things?

skoelpin — Mon, 24 Oct 2016 13:56:01 GMT

I believe sinkhole is the only supported property of move_policy so in my opinion, no this is not possible. You could always script it by setting a daily cron schedule

Re: Can move_policy actually move things?

TStrauch — Mon, 24 Oct 2016 14:51:05 GMT

Correct. Splunk has no mechanism to move files around in the filesystem.

topic Re: Can move_policy actually move things? in Getting Data In

Can move_policy actually move things?

Re: Can move_policy actually move things?

Re: Can move_policy actually move things?