Implementing Splunk 7 - Third Edition

Destructively indexing files

If you receive logfiles in batches, you can use the batch input to consume logs and then delete them. This should only be used against a copy of the logs.

See the following example:

[batch:///var/batch/logs/*/access.log*] 
sourcetype=access 
host_segment=4 
move_policy = sinkhole 

This stanza would index the files in the given directory and then delete the files. Make sure this is what you want to do!