Getting Data In

How to delete data from syslog-ng after Splunk indexes it, and confirm the data is indexed before deletion?

ckillg
Path Finder

Is there a way to have Splunk delete the data from a syslog-ng server after it indexes it? Would like to confirm that data is indexed before it gets deleted.

0 Karma

shtychkn
Engager

Hey ckillg,

You could also set log rotation in syslog-ng to delete logs after a few days.

https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-g...

good luck.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi ckillg,

if you're looking at inputs.conf http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/Inputsconf there is the batch mode which will delete a file after it has been indexed by Splunk....but it has no confirmation method.

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...