https://community.splunk.com/t5/Splunk-Search/How-do-you-get-logs-regarding-a-deleted-or-modified-file/m-p/434203#M174178 <P>many answers regarding this use case in this portal<BR /> quick search provided some links:<BR /> <A href="https://answers.splunk.com/answers/561699/how-can-i-determine-who-deleted-a-file-from-a-shar.html">https://answers.splunk.com/answers/561699/how-can-i-determine-who-deleted-a-file-from-a-shar.html</A><BR /> <A href="https://answers.splunk.com/answers/477055/how-to-detect-when-files-are-deleted-modified-or-r.html">https://answers.splunk.com/answers/477055/how-to-detect-when-files-are-deleted-modified-or-r.html</A><BR /> <A href="https://www.splunk.com/blog/2013/07/08/audit-file-access-and-change-in-windows.html">https://www.splunk.com/blog/2013/07/08/audit-file-access-and-change-in-windows.html</A></P> <P>in any case, you will have to enable auditing at the relevant directory(ies) </P> <P>note: it can become very chatty data when you enable plenty of auditing rules on large / often approached file systems</P> <P>hope it helps </P> Tue, 11 Dec 2018 13:29:25 GMT adonio 2018-12-11T13:29:25Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-logs-regarding-a-deleted-or-modified-file/m-p/434202#M174177 <P>How to get logs do you get logs regarding deleting or modifying file / Folder from servers?</P> Tue, 11 Dec 2018 13:05:03 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-logs-regarding-a-deleted-or-modified-file/m-p/434202#M174177 jabirabdulkader 2018-12-11T13:05:03Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-logs-regarding-a-deleted-or-modified-file/m-p/434203#M174178 <P>many answers regarding this use case in this portal<BR /> quick search provided some links:<BR /> <A href="https://answers.splunk.com/answers/561699/how-can-i-determine-who-deleted-a-file-from-a-shar.html">https://answers.splunk.com/answers/561699/how-can-i-determine-who-deleted-a-file-from-a-shar.html</A><BR /> <A href="https://answers.splunk.com/answers/477055/how-to-detect-when-files-are-deleted-modified-or-r.html">https://answers.splunk.com/answers/477055/how-to-detect-when-files-are-deleted-modified-or-r.html</A><BR /> <A href="https://www.splunk.com/blog/2013/07/08/audit-file-access-and-change-in-windows.html">https://www.splunk.com/blog/2013/07/08/audit-file-access-and-change-in-windows.html</A></P> <P>in any case, you will have to enable auditing at the relevant directory(ies) </P> <P>note: it can become very chatty data when you enable plenty of auditing rules on large / often approached file systems</P> <P>hope it helps </P> Tue, 11 Dec 2018 13:29:25 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-logs-regarding-a-deleted-or-modified-file/m-p/434203#M174178 adonio 2018-12-11T13:29:25Z