|
What's the recommended best practice for pruning a directory after Splunk indexes its files? I want to create a "drop box" directory where I can drop files and have Splunk index them, but I don't want the directory to become a management problem. Can Splunk be configured so that once it reads and successfully indexes a log file, can it also delete the file? I'm trying to avoid prematurely deleting files before splunk has a chance to index them, but I also want to avoid chewing up disk space due to too many files hanging around. |
|
The batch input mode of Splunk does exactly this: http://www.splunk.com/base/Documentation/latest/admin/MonitorFilesAndDirectories#Why_use_upload_or_batch You can do this via the web by visiting: and then selecting either:
Or, you can do this at the command line by copying files directly into the sinkhole at: |
|
Hi HKing, did you find a way to do this after? I am seeing the same problem in $SPLUNK_HOME/var/spool/splunk and am wondering if we can modify splunk to remove the files once indexed. |
|
Did we get any solution on this , I too have the similar requirement |
