I am doing some testing on batch inputs and trying to find out when does the batch input deletes a file. Does it immediately delete it after indexing or does it wait for all the inputs (sending data to same index) to be completed before deleting.
For example if i create hundreds of stanzas in inputs.conf (for Folder1, Folder 2 and so on) such as below, will the files be deleted immediately after indexing or will splunk wait for all the stanzas (sending data to same index) to be indexed before deleting the files?
```
[batch:///cslbuckets/Folder1]
disabled = false
recursive = true
index = aws-cloudtrail-splunk
sourcetype = aws:cloudtrail
initCrcLength = 2048
crcSalt =
move_policy = sinkhole
[batch:///cslbuckets/Folder2]
disabled = false
recursive = true
index = aws-cloudtrail-splunk
sourcetype = aws:cloudtrail
initCrcLength = 2048
crcSalt =
move_policy = sinkhole
```
↧