https://community.splunk.com/t5/Getting-Data-In/sinkhole-policy/m-p/81665#M97129 <P>This should do it -</P> <PRE><CODE>[batch://YOURPATHHERE] move_policy = sinkhole host=HHHH followSymlink = false index=XXXXXX </CODE></PRE> <P>Where XXXXXX is the name of the index where you want to send the data</P> Wed, 09 Jan 2013 02:01:11 GMT lguinn2 2013-01-09T02:01:11Z https://community.splunk.com/t5/Getting-Data-In/sinkhole-policy/m-p/81664#M97128 <P>I would like to use the sinkwhole policy to tell splunk to index a folder.<BR /> Please see below. I need to send these lgos to a seperate index. How can I define the index here to be sent? Whats the syntax.<BR /> Also if I append the below to the input.conf is it correct? There are some other stanzas in the input.conf already.</P> <P>In $SPLUNK_HOME/etc/system/local/inputs.conf<BR /> [batch://YOURPATHHERE]<BR /> move_policy = sinkhole<BR /> host=HHHH<BR /> followSymlink = false</P> Mon, 28 Sep 2020 13:04:02 GMT https://community.splunk.com/t5/Getting-Data-In/sinkhole-policy/m-p/81664#M97128 indikaw 2020-09-28T13:04:02Z https://community.splunk.com/t5/Getting-Data-In/sinkhole-policy/m-p/81665#M97129 <P>This should do it -</P> <PRE><CODE>[batch://YOURPATHHERE] move_policy = sinkhole host=HHHH followSymlink = false index=XXXXXX </CODE></PRE> <P>Where XXXXXX is the name of the index where you want to send the data</P> Wed, 09 Jan 2013 02:01:11 GMT https://community.splunk.com/t5/Getting-Data-In/sinkhole-policy/m-p/81665#M97129 lguinn2 2013-01-09T02:01:11Z https://community.splunk.com/t5/Getting-Data-In/sinkhole-policy/m-p/81666#M97130 <P>can you confirm other part of my question. in the input.conf. can i just append this ?</P> Wed, 09 Jan 2013 02:07:47 GMT https://community.splunk.com/t5/Getting-Data-In/sinkhole-policy/m-p/81666#M97130 indikaw 2013-01-09T02:07:47Z