How to write a query that will fetch logs that will identify files that were deleted?

[Vipin_Pavithran]

Hi All,

Some files has been deleted by someone from one of the  server, I need to investigate on that. We only know the host name but not sure which file is deleted or by whom.

Can anyone tell me exact query I need to type in search head to fetch the logs from Splunk to identify if any files has been deleted from my server.

I'm totally new to Splunk, kindly assist
 
Regards,
Vipin

[richgalloway]

We can't say what the exact query should be without knowing everything about your Splunk environment.  To answer in general terms requires knowing what data is known about the files.  Are you Splunking the entire file system?  Do you have audit logs in Splunk?  Splunk only knows what the server tells it so if the server didn't notify Splunk about the files being deleted then no search query will find that information.