At what point in the batch Input process is a file deleted?

[chintu_jain]

I am doing some testing on batch inputs and trying to find out when the batch input deletes a file. Does it immediately delete it after indexing or does it wait for all the inputs (sending data to same index) to be completed before deleting?

For example, if i create hundreds of stanzas in inputs.conf (for Folder1, Folder 2 and so on) such as below, will the files be deleted immediately after indexing or will Splunk wait for all the stanzas (sending data to same index) to be indexed before deleting the files?

  ```
[batch:///cslbuckets/Folder1] 
disabled = false 
recursive = true 
index = aws-cloudtrail-splunk 
sourcetype = aws:cloudtrail 
initCrcLength = 2048 
crcSalt =  
move_policy = sinkhole 

[batch:///cslbuckets/Folder2] 
disabled = false 
recursive = true 
index = aws-cloudtrail-splunk 
sourcetype = aws:cloudtrail 
initCrcLength = 2048 
crcSalt =  
move_policy = sinkhole
```

[VatsalJagani]

Hi @chintu_jain,

batch stanza of inputs.conf DELETES THEM IMMEDIATELY, and that is also mentioned in the documentation of inputs.conf, you can search and read that.

[chintu_jain]

I have created a batch input for hundreds of stanzas monitoring millions of files and i am seeing that the files are not being deleted. The splunkd process is crashing probably due to monitoring and indexing millions files on a single instance. I believe that the files will not be deleted immediately but splunk will wait for all the inputs (loaded onto memory ?) to be completed. I am unable to verify this myself at the moment as splunkd is crashing before all the files are indexed.

[VatsalJagani]

Splunk instance should have enough resource configuration as you have hundreds of inputs.