If a someone reruns a script to get an output that replaces the old file, will my dashboard only include new information, or will the old information stay indexed?

[alanxu]

Hello Everyone,

I presented my project to my team and one coworker had a few concerns about my dashboard.

1) If they rerun a script to get an output that replaces the old file, will my dashboard only include the new information? Or does the old information stay indexed even though the file was deleted?

And thank you Splunk Community with helping me these past weeks!

[jensonthottian · Accepted solution]

1) If they rerun a script to get an output that replaces the old file. Will my dashboard only include the new information? Or does the old information stay indexed even though the file was deleted -

Is this output an CSV which is imported in Splunk? if yes then you will only have new CSV information at your disposal.
Is this output a text file which is forwarded to Splunk indexer? If yes, then if the old text file is forwarded to Splunk indexer before it is replaced by a new file you will have both old and new file at your disposal with different timestamps.

2) If my account is deleted so are my alerts and dashboards?

If your account is deleted all your private alerts and dashboards are not deleted. Since those are set as "private" permission, can be accessed and edited by an admin.

[alanxu]

It is an output text file that is automatically indexed in Splunk.

And the alerts and dashboards are in the app now.

Thank you for your answer