https://community.splunk.com/t5/Getting-Data-In/For-inputs-conf-can-the-time-before-close-setting-be-used-with/m-p/536765#M89976 <P>Follow on question to <A href="https://community.splunk.com/t5/Getting-Data-In/Can-batch-read-a-partial-file-such-that-the-of-events-indexed-is/m-p/536557#M89931" target="_blank">https://community.splunk.com/t5/Getting-Data-In/Can-batch-read-a-partial-file-such-that-the-of-events-indexed-is/m-p/536557#M89931</A></P><P>[Q] For inputs.conf, can the time_before_close setting be used with [batch]?</P><P>The inputs.conf file specifically indicates which [monitor] settings are compatible with [batch] and this setting is not included.</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf</A></P><P>From inputs.conf</P><PRE> The following settings work identically as for [monitor::] stanzas, documented above host_regex = &lt;regular expression&gt; host_segment = &lt;integer&gt; crcSalt = &lt;string&gt; recursive = &lt;boolean&gt; whitelist = &lt;regular expression&gt; blacklist = &lt;regular expression&gt; initCrcLength = &lt;integer&gt;</PRE><P>&nbsp;</P><P>&nbsp;</P> Fri, 22 Jan 2021 00:13:05 GMT actionabledata 2021-01-22T00:13:05Z https://community.splunk.com/t5/Getting-Data-In/For-inputs-conf-can-the-time-before-close-setting-be-used-with/m-p/536765#M89976 <P>Follow on question to <A href="https://community.splunk.com/t5/Getting-Data-In/Can-batch-read-a-partial-file-such-that-the-of-events-indexed-is/m-p/536557#M89931" target="_blank">https://community.splunk.com/t5/Getting-Data-In/Can-batch-read-a-partial-file-such-that-the-of-events-indexed-is/m-p/536557#M89931</A></P><P>[Q] For inputs.conf, can the time_before_close setting be used with [batch]?</P><P>The inputs.conf file specifically indicates which [monitor] settings are compatible with [batch] and this setting is not included.</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf</A></P><P>From inputs.conf</P><PRE> The following settings work identically as for [monitor::] stanzas, documented above host_regex = &lt;regular expression&gt; host_segment = &lt;integer&gt; crcSalt = &lt;string&gt; recursive = &lt;boolean&gt; whitelist = &lt;regular expression&gt; blacklist = &lt;regular expression&gt; initCrcLength = &lt;integer&gt;</PRE><P>&nbsp;</P><P>&nbsp;</P> Fri, 22 Jan 2021 00:13:05 GMT https://community.splunk.com/t5/Getting-Data-In/For-inputs-conf-can-the-time-before-close-setting-be-used-with/m-p/536765#M89976 actionabledata 2021-01-22T00:13:05Z https://community.splunk.com/t5/Getting-Data-In/For-inputs-conf-can-the-time-before-close-setting-be-used-with/m-p/635210#M108700 <P>This is no longer the case. See&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf</A></P><PRE># The following settings work identically as for [monitor::] stanzas, # documented previously host_regex = &lt;regular expression&gt; host_segment = &lt;integer&gt; crcSalt = &lt;string&gt; recursive = &lt;boolean&gt; whitelist = &lt;regular expression&gt; blacklist = &lt;regular expression&gt; initCrcLength = &lt;integer&gt; time_before_close = &lt;integer&gt;</PRE> Mon, 20 Mar 2023 21:55:15 GMT https://community.splunk.com/t5/Getting-Data-In/For-inputs-conf-can-the-time-before-close-setting-be-used-with/m-p/635210#M108700 splunkyj 2023-03-20T21:55:15Z