Getting Data In

Upload multiple pre-existing IIS files

Engager

Hello, I have historical IIS log files on my PC's "D" drive that I would like to input into Splunk. Per the documentation:

Use the batch input type in inputs.conf to load files once and destructively. By default, Splunk's batch processor is located in $SPLUNK_HOME/var/spool/splunk. If you move a file into this directory, Splunk indexes it and then deletes it.

Does "loading files destructively" mean that the files will be deleted from my computer after they are uploaded?

Thank you,

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

Yes, that is exactly what would occur. That is why it says that Splunk will load the file and then delete it. So, you should probably copy the files from their original location into $SPLUNK_HOME/var/spool/splunk/, then you won't have any problems.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Yes, that is exactly what would occur. That is why it says that Splunk will load the file and then delete it. So, you should probably copy the files from their original location into $SPLUNK_HOME/var/spool/splunk/, then you won't have any problems.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Yes. If you copy a file into the directory, it will be indexed, then deleted. You can copy it instead and the original won't be deleted.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!