Security

ignoreOlderThan Invalid for batch input

ips_mandar
Builder

Does ignoreOlderThanstanza in inputs.conf is Invalid for batch input?
I am getting error as-"Invalid key in stanza"

[batch:\\D:\...\*.zip]
move_policy = sinkhole
index=abc
ignoreOlderThan = 72h
Tags (1)
0 Karma
1 Solution

solarboyz1
Builder

A batch input does destructive reads of the files, so its not expecting older files to be in that location.
Which is why ignoreOlderThan isn`t listed as a valid option for a batch input:

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Inputsconf#BATCH_.28.22Upload_a_file.22_in_...

View solution in original post

0 Karma

solarboyz1
Builder

A batch input does destructive reads of the files, so its not expecting older files to be in that location.
Which is why ignoreOlderThan isn`t listed as a valid option for a batch input:

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Inputsconf#BATCH_.28.22Upload_a_file.22_in_...

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...