alert when deleting a file

sabdulkader · ‎10-28-2018

how to get an alert when a file is deleted.what is the exact command for that search

cutright_j · ‎10-29-2018

What do you mean, when a file is deleted? A file on an OS? If so what OS, and what auditing do you have for that OS? A file on Splunk? Splunk event data?

iamarkaprabha · ‎10-28-2018

Hi ,
Please create the alert based on this

  index=_audit "action=search" search=*delete*

alert when deleting a file

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs

Join the Conversation

alert when deleting a file

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs