Getting Data In

How to write a query that will fetch logs that will identify files that were deleted?

Vipin_Pavithran
Explorer

Hi All,

Some files has been deleted by someone from one of the  server, I need to investigate on that. We only know the host name but not sure which file is deleted or by whom.

Can anyone tell me exact query I need to type in search head to fetch the logs from Splunk to identify if any files has been deleted from my server.

I'm totally new to Splunk, kindly assist
 
Regards,
Vipin

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

We can't say what the exact query should be without knowing everything about your Splunk environment.  To answer in general terms requires knowing what data is known about the files.  Are you Splunking the entire file system?  Do you have audit logs in Splunk?  Splunk only knows what the server tells it so if the server didn't notify Splunk about the files being deleted then no search query will find that information.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...