MENU
A customer would like Splunk to delete files after they've been ingested. The Universal Forwarder has read/ write access to the directory structure. Which input type would be most appropriate to use in order to ensure files are ingested and then deleted afterwards?
Suggested Answer: B
Get Premium SPLK-3003 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
11 comments · newest first
BE
Beckie
11 months ago
Not convinced Batch is the best choice here.
LU
Luisa
11 months ago
Definitely Batch! It handles file deletion perfectly.
RO
Ronny
12 months ago
Wait, can we really delete files automatically after ingestion?
BE
Bettye
12 months ago
I think Monitor would work too, but not sure about deletion.
RE
Refugia
12 months ago
Batch is the way to go for this!
ER
Erick
1 year ago
I’m confused about Fschange; I don’t recall it being used for deleting files after ingestion. Could it be a trick option?
LU
Luke
1 year ago
I’m leaning towards the Script option, but I feel like it might not be the best fit for this scenario.
MA
Mabel
1 year ago
I remember practicing a similar question, and I think Monitor is more for ongoing file monitoring rather than deleting after ingestion.
FR
Franklyn
1 year ago
I think the Batch input type might be the right choice since it can handle files and delete them after processing, but I'm not entirely sure.
DO
Dong
1 year ago
Okay, I think I've got it. The merge code needs to reference the output of the HTTP Action, which is labeled as CaseData, and then pass that to the input of the DataRaptor Transform Action. I'll go with option B.
TE
Teddy
1 year ago
Hmm, narrowing the scope of the first phase - that's an interesting approach. I'll need to consider which options would be the most strategic and practical.