Can Splunk Universal forwarder be used to delete logs from a particular server.(Log rotation/deletion)

[bmoniz]

e.g. I have a universal forwarder installed on a server on which an application is running. The purpose of the UF is to send logs of this application to the splunk server for monitoring purposes. This application however has a load issue and needs log rotation to be put in place, else the server shuts down. I know there are conventional ways of setting up Log rotation, but can Splunk UF be used to delete the logs from source server and then index, instead of just copying the data and indexing it?

Please let me know if you guys need further clarification.

[davpx]

A batch input can be used to delete a file after it is forwarded but this should not be used for streaming logs. It sounds like you'll need to set up log rotate to tackle this issue.