I read somewhere this is possible, however I can't find where or how - looking for confirmation:
Essentially I have the below scenario:
FileA is being monitored by ForwarderA for new data. When new data is added to FileA, then ForwarderA will send this data to IndexerA and confirm receipt. Once completed, I want ForwarderA to remove the data it has transmitted successfully from FileA.
Does anyone know if this is possible and if so how one might go about doing this?
Yes this can be done, Batch Mode should be configured on the directory/file as per the below configuration:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf?utm_source=answers&utm_medium=in...
You use the batch input method instead of a monitor to remove files after reading them.
Sorry for writing a second answer, I couldn't see that your answer was still in moderation.
No worries - I guessed that was the case
Yes this can be done, Batch Mode should be configured on the directory/file as per the below configuration:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf?utm_source=answers&utm_medium=in...