topic How to write a query that will fetch logs that will identify files that were deleted? in Getting Data In

How to write a query that will fetch logs that will identify files that were deleted?

Vipin_Pavithran — Tue, 10 May 2022 21:55:58 GMT

Hi All,

Some files has been deleted by someone from one of the server, I need to investigate on that. We only know the host name but not sure which file is deleted or by whom.

Can anyone tell me exact query I need to type in search head to fetch the logs from Splunk to identify if any files has been deleted from my server.

I'm totally new to Splunk, kindly assist

Regards,
Vipin

Re: How to write a query that will fetch logs that will identify files that were deleted?

richgalloway — Wed, 11 May 2022 13:05:38 GMT

We can't say what the exact query should be without knowing everything about your Splunk environment. To answer in general terms requires knowing what data is known about the files. Are you Splunking the entire file system? Do you have audit logs in Splunk? Splunk only knows what the server tells it so if the server didn't notify Splunk about the files being deleted then no search query will find that information.