e.g. I have a universal forwarder installed on a server on which an application is running. The purpose of the UF is to send logs of this application to the splunk server for monitoring purposes. This application however has a load issue and needs log rotation to be put in place, else the server shuts down. I know there are conventional ways of setting up Log rotation, but can Splunk UF be used to delete the logs from source server and then index, instead of just copying the data and indexing it?
Please let me know if you guys need further clarification.