I set up my batch stanza to delete the file once indexed, but sometime, the file can't be due to permission error and the same file is indexed multiple time.
I used both of the following options:
initCrcLength = 2000 crcSalt =
But the same file is still indexed again.
How can I set up the stanza not to read the same file?
Is that possible with batch stanza which deletes the files? (move_policy = sinkhole)
The move_policy MUST be sinkhole for that to work as you want.
movepolicy = sinkhole
* This setting is required. You must include "movepolicy = sinkhole"
when you define batch inputs.
The move_policy is set.
Here my actual configuration :
sourcetype = fluxeditique:cabestan:dtr:in:planapurement3
initCrcLength = 2000
move_policy = sinkhole
I replaced "crcSalt = " with "initCrcLength = 2000" but the result is the same.
CRC settings belong to the monitor::// stanzas, not the batch ones.
It seems you need to take care of the deleting permissions of the files for Splunk user to be able to delete them.