Deployment Architecture

Deletion of a log file being indexed by Splunk

madhavi_fmr
New Member

I have installed a forwarded on a machine and configure it to read some local log file.A Splunk indexer and a search machine is able to read the data.
In case if the log file is not available in the system, what happens ? If it gets deleted by some user,what will happen ?

Tags (1)
0 Karma

Cris
Explorer

Nothing happens! The forwarder continues to remain pending file.

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...