Getting Data In

batch stanza in inputs.conf with nullQueue not processing

kenoski
Path Finder

Hi,

I have a batch stanza in my inputs.conf file of my application. I would like to use it to remove old files from the application that could be causing problems for the users. Here is an example:

[batch://C:\Program Files\Splunk\etc\apps\<myApp>\local\ui\views\Old_View_File.xml]
disabled = false
queue=nullQueue
move_policy=sinkhole

It appears that Splunk is noticing the requested input, due to the _internal DB log files, but the requested file is not being processed and removed.

Any suggestions?

Thx.

0 Karma
1 Solution

somesoni2
Revered Legend

THe possible values of attribute queue in inputs.conf are parsingQueue|indexQueue. That's why it's not processing the file at all.

Instead of writing a batch input (and you need to setup a props/transforms on Heavy forwarder/Indexer to route the data to nullQueue) why don't you setup scheduler task on the server OR setup a scripted input with the script deleting you unwanted files.

View solution in original post

0 Karma

somesoni2
Revered Legend

THe possible values of attribute queue in inputs.conf are parsingQueue|indexQueue. That's why it's not processing the file at all.

Instead of writing a batch input (and you need to setup a props/transforms on Heavy forwarder/Indexer to route the data to nullQueue) why don't you setup scheduler task on the server OR setup a scripted input with the script deleting you unwanted files.

0 Karma

kenoski
Path Finder

I had a Splunk Support case open asking how to remove files, and they suggested the batch and inputs.conf file method with nullQueue......they just forgot to mention that I would need to to do the other modifications also.

I'll give the scripted input a try.

thx.

0 Karma
Get Updates on the Splunk Community!

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...