Getting Data In

Do sinkholes work on forwarders?

Michael_Wilde
Splunk Employee
Splunk Employee

Does a sinkhole work on all types of forwarders?

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

By "sinkhole", I assume you mean the ability to copy a file into $SPLUNK_HOME/var/spool/splunk, and have it indexed then automatically deleted by Splunk. Yes, it is enabled on both heavy (SplunkForwarder) and light (SplunkLightForwarder) forwarders.