Splunk universal forwarder is reading files from directory intermittently. I am writing file to directory at regular intervals.

[lavkush]

We have installed universal forwarder on our machine and mapped the local directory on splunk server. Forwarding and receiving is also configured.I am writing file to directory at regular intervals. But sometimes splunk forwarder is unable to forward the file to splunk. Is there any configuration that need to be made? Also is there any mechanism to delete the file which has been read by splunk forwarder?

[ddrillic]

As @somesoni2 described we can see a discussion about it -

Can Splunk delete old log files after indexing them?

It says -

About missing data the following might help - I can't find my data!

[somesoni2]

Check splunkd logs on the UF to see if you get any error for the file that you're monitoring.

For deleting the file after it's read, use the [batch:// mode instead of [monitor://. See this for more info https://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Inputsconf#BATCH_.28.22Upload_a_file.22_in_...