Getting Data In

Why after enabling Move policy, data is still there?

Vivek_1404
Engager

Even after enabling move_policy=sinkhole, why is data still in there, verified that the path included in the monitor is not included in batch stanza

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The move_policy setting applies only to batch inputs.  If the stanza is not a batch stanza then move_policy is ignored.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See Splunk Platform & Observability Innovations at Cisco Live EMEA

Hi Splunkers, Learn about what’s next for Splunk Platform at Cisco Live EMEA.  Data silos are a big challenge ...

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...