Is it possible to have a Splunk forwarder remove data from a monitored file after it has been successfully forwarded to an indexer?

[LewisWheeler]

I read somewhere this is possible, however I can't find where or how - looking for confirmation:

Essentially I have the below scenario:
FileA is being monitored by ForwarderA for new data. When new data is added to FileA, then ForwarderA will send this data to IndexerA and confirm receipt. Once completed, I want ForwarderA to remove the data it has transmitted successfully from FileA.

Does anyone know if this is possible and if so how one might go about doing this?

[jeffland]

You use the batch input method instead of a monitor to remove files after reading them.

[jeffland]

Sorry for writing a second answer, I couldn't see that your answer was still in moderation.

[LewisWheeler]

No worries - I guessed that was the case

[LewisWheeler · Accepted solution]

Yes this can be done, Batch Mode should be configured on the directory/file as per the below configuration:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf?utm_source=answers&utm_medium=in...