alert when deleting a file

sabdulkader · ‎10-28-2018

how to get an alert when a file is deleted.what is the exact command for that search

cutright_j · ‎10-29-2018

What do you mean, when a file is deleted? A file on an OS? If so what OS, and what auditing do you have for that OS? A file on Splunk? Splunk event data?

iamarkaprabha · ‎10-28-2018

Hi ,
Please create the alert based on this

  index=_audit "action=search" search=*delete*

alert when deleting a file

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Analytics Workspace removal in Splunk 10.6

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

Join the Conversation

alert when deleting a file

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Analytics Workspace removal in Splunk 10.6

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar