https://community.splunk.com/t5/Monitoring-Splunk/File-cleanup-on-monitored-directory-question/m-p/52981#M7017 <OL> <LI> Yes, once data has been indexed by Splunk, you do not need the original files.</LI> <LI> By looking at the main dashboard, the "sources" list will show you all of the files that Splunk has indexed. Inspect the 'latest time' column to determine where Splunk is in its indexing. (Files under a gigabyte generally only take at most a few minutes to index; it completely depends on your hardware).</LI> </OL> Wed, 03 Aug 2011 19:11:57 GMT Johnvey 2011-08-03T19:11:57Z https://community.splunk.com/t5/Monitoring-Splunk/File-cleanup-on-monitored-directory-question/m-p/52980#M7016 <P>I ran out of space as I am using the free version on an old server for some basic log monitoring. I deleted some old stuff, but can't find an answer after looking here and on the old forum.</P> <P>If I am monitoring a directory (/var/xlogs). Now xlogs is a basic folder that 2 webservers copy files hourly over to. Those are now months old. If I delete files from yesterday back, and they have been indexed, I assume the data is still there, right?</P> <P>Also, I am looking at the earliest and latest date. The latest shows 7/25/11 as it ran out of space, so that's fixed and there are new files there. How do I see what's not indexed yet as well as what is (hoping I can delete the files that are indexed).</P> <P>Tnx</P> Wed, 03 Aug 2011 18:16:38 GMT https://community.splunk.com/t5/Monitoring-Splunk/File-cleanup-on-monitored-directory-question/m-p/52980#M7016 xlancealotx 2011-08-03T18:16:38Z https://community.splunk.com/t5/Monitoring-Splunk/File-cleanup-on-monitored-directory-question/m-p/52981#M7017 <OL> <LI> Yes, once data has been indexed by Splunk, you do not need the original files.</LI> <LI> By looking at the main dashboard, the "sources" list will show you all of the files that Splunk has indexed. Inspect the 'latest time' column to determine where Splunk is in its indexing. (Files under a gigabyte generally only take at most a few minutes to index; it completely depends on your hardware).</LI> </OL> Wed, 03 Aug 2011 19:11:57 GMT https://community.splunk.com/t5/Monitoring-Splunk/File-cleanup-on-monitored-directory-question/m-p/52981#M7017 Johnvey 2011-08-03T19:11:57Z https://community.splunk.com/t5/Monitoring-Splunk/File-cleanup-on-monitored-directory-question/m-p/52982#M7018 <P>Cool, thought so just wanted to confirm. Thanks for both.</P> Thu, 04 Aug 2011 14:47:39 GMT https://community.splunk.com/t5/Monitoring-Splunk/File-cleanup-on-monitored-directory-question/m-p/52982#M7018 xlancealotx 2011-08-04T14:47:39Z https://community.splunk.com/t5/Monitoring-Splunk/File-cleanup-on-monitored-directory-question/m-p/52983#M7019 <P>Just to make sure I understand this correctly, if I delete a file specified as a data input that has already been completely indexed, it is okay?</P> <P>I have some rather large files of old apache logs that have been indexed. I need to delete them to free up some space on the Splunk server. Just want to make sure that I won't lose the indexed/searchable data associated with these files.</P> <P>Thanks.</P> Mon, 19 Sep 2011 21:31:22 GMT https://community.splunk.com/t5/Monitoring-Splunk/File-cleanup-on-monitored-directory-question/m-p/52983#M7019 atiu 2011-09-19T21:31:22Z https://community.splunk.com/t5/Monitoring-Splunk/File-cleanup-on-monitored-directory-question/m-p/52984#M7020 <P>How to automatize the deletion of files using the Splunk Forwarder ?</P> <P>David</P> Mon, 25 Mar 2013 14:29:35 GMT https://community.splunk.com/t5/Monitoring-Splunk/File-cleanup-on-monitored-directory-question/m-p/52984#M7020 dcampill 2013-03-25T14:29:35Z