Upload multiple pre-existing IIS files

[cprundeanu]

Hello, I have historical IIS log files on my PC's "D" drive that I would like to input into Splunk. Per the documentation:

Use the batch input type in inputs.conf to load files once and destructively. By default, Splunk's batch processor is located in $SPLUNK_HOME/var/spool/splunk. If you move a file into this directory, Splunk indexes it and then deletes it.

Does "loading files destructively" mean that the files will be deleted from my computer after they are uploaded?

Thank you,

[jbsplunk · Accepted solution]

Yes, that is exactly what would occur. That is why it says that Splunk will load the file and then delete it. So, you should probably copy the files from their original location into $SPLUNK_HOME/var/spool/splunk/, then you won't have any problems.

[gkanapathy]

Yes. If you copy a file into the directory, it will be indexed, then deleted. You can copy it instead and the original won't be deleted.