A customer would like Splunk to delete files after they've been ingested. The Universal Forwarder has read/write access to the directory structure. Which input type would be most appropriate to use in order to ensure files are ingested and then deleted afterwards?
The most appropriate input type to use in order to ensure files are ingested and then deleted afterwards is 'Batch'. The 'Batch' input type in Splunk is designed to ingest files and then remove them from the directory once they have been successfully indexed. This behavior is exactly what is required in this scenario, as the customer wants the files to be deleted after ingestion.
Batch will delete the file after ingesting
B, after read removed the files
Batch will delete it after ingesting
B is the correct