Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- batch stanza in inputs.conf with nullQueue not pro...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a batch stanza in my inputs.conf file of my application. I would like to use it to remove old files from the application that could be causing problems for the users. Here is an example:
[batch://C:\Program Files\Splunk\etc\apps\<myApp>\local\ui\views\Old_View_File.xml]
disabled = false
queue=nullQueue
move_policy=sinkhole
It appears that Splunk is noticing the requested input, due to the _internal DB log files, but the requested file is not being processed and removed.
Any suggestions?
Thx.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
THe possible values of attribute queue in inputs.conf are parsingQueue|indexQueue. That's why it's not processing the file at all.
Instead of writing a batch input (and you need to setup a props/transforms on Heavy forwarder/Indexer to route the data to nullQueue) why don't you setup scheduler task on the server OR setup a scripted input with the script deleting you unwanted files.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
THe possible values of attribute queue in inputs.conf are parsingQueue|indexQueue. That's why it's not processing the file at all.
Instead of writing a batch input (and you need to setup a props/transforms on Heavy forwarder/Indexer to route the data to nullQueue) why don't you setup scheduler task on the server OR setup a scripted input with the script deleting you unwanted files.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I had a Splunk Support case open asking how to remove files, and they suggested the batch and inputs.conf file method with nullQueue......they just forgot to mention that I would need to to do the other modifications also.
I'll give the scripted input a try.
thx.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Automating Threat Operations and Threat Hunting with Recorded Future
Keep the Learning Going with the New Best of .conf Hub
Splunk Community Badges!
