Getting Data In

sinkhole policy

indikaw
Explorer

I would like to use the sinkwhole policy to tell splunk to index a folder.
Please see below. I need to send these lgos to a seperate index. How can I define the index here to be sent? Whats the syntax.
Also if I append the below to the input.conf is it correct? There are some other stanzas in the input.conf already.

In $SPLUNK_HOME/etc/system/local/inputs.conf
[batch://YOURPATHHERE]
move_policy = sinkhole
host=HHHH
followSymlink = false

Tags (1)
0 Karma

lguinn2
Legend

This should do it -

[batch://YOURPATHHERE]
move_policy = sinkhole
host=HHHH
followSymlink = false
index=XXXXXX

Where XXXXXX is the name of the index where you want to send the data

0 Karma

indikaw
Explorer

can you confirm other part of my question. in the input.conf. can i just append this ?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...