Solved: delete source file after indexing - Splunk Community

Getting Data In

how to judge if a file was eaten by splunk, and then i can delete or move it immediately?

1 Solution

Solution

Use Batch stanza instead of monitor:

http://docs.splunk.com/Documentation/Splunk/6.0/admin/inputsconf

Regards

View solution in original post

Solution

Use Batch stanza instead of monitor:

http://docs.splunk.com/Documentation/Splunk/6.0/admin/inputsconf

Regards

Get Updates on the Splunk Community!

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in Splunk Cloud Platform ...

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Why Universal Forwarders Should Not Be Used as Intermediate Forwarders A practical Splunk forwarding topology ...

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Long before a new capability reaches the keynote stage, it begins as an idea waiting to be tested. At ...