All Apps and Add-ons

What is the use of batch and move_policy = sinkhole?

VijaySrrie
Builder

Hi All,

What is the use of 

move_policy = sinkhole

and on which scenario we will use batch (Batch will index the file and delete but in which application or server this should be used?) 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The move_policy setting is required with a batch input as a way of making sure the admin understands what he or she is doing.  A batch input might be used to index a file that will not be updated.

---
If this reply helps you, Karma would be appreciated.
0 Karma

VijaySrrie
Builder

what happens when move_policy setting is not given in the batch config?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I believe the batch input will be ignored if move_policy is missing.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...