Getting Data In

How to use batch in inputs.conf file to upload files?

SplunkDash
Motivator

Hello,

I have some use cases where we need to delete files right after those are read/push by UF. How I would do it. There are any ways we may let the UF to do this task using batch in inputs.conf file. Any recommendation would be highly appreciated, thank you!

Labels (2)
0 Karma
1 Solution

m_pham
Splunk Employee
Splunk Employee

It should work fine. Since the logs will be deleted, best you double check the file path and index/sourcetype names.

View solution in original post

m_pham
Splunk Employee
Splunk Employee

See the batch stanza configs below:

Use the 'batch' input for large archives of historic data. If you
want to continuously monitor a directory or index small archives, use 'monitor'
(see the MONITOR section). 'batch' reads in the file and indexes it, and then
deletes the file on disk.

[batch://<path>]
* A one-time, destructive input of files in <path>.
* This stanza must include the 'move_policy = sinkhole' setting.
* This input reads and indexes the files, then DELETES THEM IMMEDIATELY.
* For continuous, non-destructive inputs of files, use 'monitor' instead.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/inputsconf#BATCH_.28.22Upload_a_file.22_in...:

SplunkDash
Motivator

Hello,

Thank you so much for your response and truly appreciate it.

Do you think following is the typical structure for inputs.conf file using batch and going to work? 

[batch:///home/mydatafolder/*.log]

disabled = false

index = myindex

sourcetype = mysourcetpye

move_policy = sinkhole 

 

Your recommendation will be highly appreciated, thank you so much again.

 

 

0 Karma

m_pham
Splunk Employee
Splunk Employee

It should work fine. Since the logs will be deleted, best you double check the file path and index/sourcetype names.

Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...