SPLK-3003 · Question #32
A customer would like Splunk to delete files after they've been ingested. The Universal Forwarder has read/write access to the directory structure. Which input type would be most appropriate to use…
The correct answer is B. Batch. Batch input is specifically designed for "consume and delete" workflows - when Splunk ingests a file via a Batch input, it processes the file once and then deletes it from the filesystem, making it the only built-in input type with this behavior. Monitor (C) is the most common…
Question
A customer would like Splunk to delete files after they've been ingested. The Universal Forwarder has read/write access to the directory structure. Which input type would be most appropriate to use in order to ensure files are ingested and then deleted afterwards?
Options
- AScript
- BBatch
- CMonitor
- DFschange
How the community answered
(14 responses)- B93% (13)
- D7% (1)
Explanation
Batch input is specifically designed for "consume and delete" workflows - when Splunk ingests a file via a Batch input, it processes the file once and then deletes it from the filesystem, making it the only built-in input type with this behavior.
Monitor (C) is the most common distractor because it also reads files from directories, but it continuously watches for new/appended content and never deletes files - it just tracks read positions. Script (A) runs external scripts to generate events and has no native file-deletion mechanism; you'd have to code deletion logic yourself, making it a workaround rather than the appropriate tool. Fschange (D) monitors the filesystem for changes (additions, modifications, deletions) and is used for file integrity monitoring, not data ingestion.
Memory tip: Think Batch = Bye-bye - the file is gone after one pass. Monitor = the file stays and is monitored forever.
Topics
Community Discussion
No community discussion yet for this question.