topic Re: Can you auto remove CSV files after indexing? in Getting Data In

Can you auto remove CSV files after indexing?

jiaqya — Thu, 17 May 2018 04:17:02 GMT

Is there a configuration in Splunk where it can remove/move a CSV file after it has been indexed? so it does not show as active in the configured data input folder for being scanned as a valid file..( since its already indexed )

John.

Re: Can you auto remove CSV files after indexing?

MuS — Thu, 17 May 2018 04:24:01 GMT

Hi jiaqya,

you are looking for the [batch://...] stanza in inputs.conf, here are the docs http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#BATCH_.28.22Upload_a_file.22_in_Splunk_Web.29:

[batch://<path>]
* A one-time, destructive input of files in <path>.
* For continuous, non-destructive inputs of files, use 'monitor' instead.

# Additional settings:

move_policy = sinkhole
* IMPORTANT: This setting is required. You *must* include
  "move_policy = sinkhole" when you define batch inputs.
* This setting causes the input to load the file destructively.

Hope this helps ...

cheers, MuS

Re: Can you auto remove CSV files after indexing?

jiaqya — Thu, 17 May 2018 06:52:42 GMT

Mus, Thanks, thats mostly what i want. But , is there an option to delete only beyond 7 days or 'n' number of days , so at least i retain few recent files...

Re: Can you auto remove CSV files after indexing?

deepashri_123 — Thu, 17 May 2018 08:46:11 GMT

Hey@MuS,

What permission does the file require for destructive input?

Re: Can you auto remove CSV files after indexing?

MuS — Tue, 22 May 2018 20:08:39 GMT

If on nix you need write (+w) permissions, and parent directory should be accessible (+x) to the user which is you want to have delete permission.

If on Windows ... ¯\_(ツ)_/¯ sorry cannot help here, but I'm sure you will find something asking google.

cheers, MuS