alert when deleting a file

sabdulkader · ‎10-28-2018

how to get an alert when a file is deleted.what is the exact command for that search

cutright_j · ‎10-29-2018

What do you mean, when a file is deleted? A file on an OS? If so what OS, and what auditing do you have for that OS? A file on Splunk? Splunk event data?

iamarkaprabha · ‎10-28-2018

Hi ,
Please create the alert based on this

  index=_audit "action=search" search=*delete*

alert when deleting a file

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Quick connection discovery mode for forwarders

Build and Launch AI Agents from Your Splunk Workflows

Splunk Cloud Application Management in Terraform

Join the Conversation

alert when deleting a file

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Quick connection discovery mode for forwarders

Build and Launch AI Agents from Your Splunk Workflows

Splunk Cloud Application Management in Terraform