How to delete data from syslog-ng after Splunk indexes it, and confirm the data is indexed before deletion?

[ckillg]

Is there a way to have Splunk delete the data from a syslog-ng server after it indexes it? Would like to confirm that data is indexed before it gets deleted.

[shtychkn]

Hey ckillg,

You could also set log rotation in syslog-ng to delete logs after a few days.

https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-g...

good luck.

[MuS]

Hi ckillg,

if you're looking at inputs.conf http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/Inputsconf there is the batch mode which will delete a file after it has been indexed by Splunk....but it has no confirmation method.

Hope this helps ...

cheers, MuS