Getting Data In

Does batch input ignore files already read?

Motivator

I have a file in a folder that is being monitored by Splunk. Its contents have been indexed. If I move that file into a batch input (read-and-delete), will the file be re-indexed, or will Splunk know it has already indexed this data already?

(The specific scenario is I am changing a folder from monitor:// to batch:// and need to know if I need to remove all the files first to avoid data duplication in Splunk.)

Tags (3)
1 Solution

Splunk Employee
Splunk Employee

so long as the policy is set to move to the sinkhole, Splunk should eat the file again.
The input could look something like this:

[batch:///some/path/some_file]
move_policy = sinkhole

without the move_policy = sinkhole setting, it won't load the files destructively and will keep track of them.

Hope this helps!

View solution in original post

Splunk Employee
Splunk Employee

so long as the policy is set to move to the sinkhole, Splunk should eat the file again.
The input could look something like this:

[batch:///some/path/some_file]
move_policy = sinkhole

without the move_policy = sinkhole setting, it won't load the files destructively and will keep track of them.

Hope this helps!

View solution in original post

Motivator

Confirmed - Splunk does no checking and will re-index the file.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!