Deployment Architecture

Deletion of a log file being indexed by Splunk

madhavi_fmr
New Member

I have installed a forwarded on a machine and configure it to read some local log file.A Splunk indexer and a search machine is able to read the data.
In case if the log file is not available in the system, what happens ? If it gets deleted by some user,what will happen ?

Tags (1)
0 Karma

Cris
Explorer

Nothing happens! The forwarder continues to remain pending file.

0 Karma
Get Updates on the Splunk Community!

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 4

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...