How to set up a stanza batch to index same file?

[arthurf]

Hello,

I set up my batch stanza to delete the file once indexed, but sometime, the file can't be due to permission error and the same file is indexed multiple time.

I used both of the following options:

initCrcLength = 2000
crcSalt = 

But the same file is still indexed again.
How can I set up the stanza not to read the same file?
Is that possible with batch stanza which deletes the files? (move_policy = sinkhole)

[tiagofbmm]

The move_policy MUST be sinkhole for that to work as you want.

move_policy = sinkhole
* This setting is required. You must include "move_policy = sinkhole"
when you define batch inputs.

[arthurf]

The move_policy is set.
Here my actual configuration :

[batch://FOLDER/Pattern]
sourcetype = fluxeditique:cabestan:dtr:in:planapurement3
index=cabestan
initCrcLength = 2000
move_policy = sinkhole

I replaced "crcSalt = " with "initCrcLength = 2000" but the result is the same.

[tiagofbmm]

CRC settings belong to the monitor::// stanzas, not the batch ones.

It seems you need to take care of the deleting permissions of the files for Splunk user to be able to delete them.

[arthurf]

Ok, so if get you correctly, it's not possible to prevent the indexation of the same file with batch stanza ?
And we need to ensure that the same log file is not generated twice, right ?

[tiagofbmm]

Yes, with batch you don't get that possibility

[arthurf]

Thanks for the confirmation.

Have a good day.