All Apps and Add-ons

What is the use of batch and move_policy = sinkhole?

VijaySrrie
Builder

Hi All,

What is the use of 

move_policy = sinkhole

and on which scenario we will use batch (Batch will index the file and delete but in which application or server this should be used?) 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The move_policy setting is required with a batch input as a way of making sure the admin understands what he or she is doing.  A batch input might be used to index a file that will not be updated.

---
If this reply helps you, Karma would be appreciated.
0 Karma

VijaySrrie
Builder

what happens when move_policy setting is not given in the batch config?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I believe the batch input will be ignored if move_policy is missing.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...