Solved: Re: Removing files in a monitored directory

michael_lee · ‎05-12-2015

hi,
I have a monitored directory that is indexed by splunk. I tried removing the files in the directory after they are indexed. Restarted the splunk daemon and I still see the file contents when searched. My question is, can I confirm that I can safely remove those files in that directory that are already indexed without any other consequences ?
thanks

richgalloway · ‎05-12-2015

Once files are indexed then data remains in Splunk until it ages out. You no longer need the source file.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎05-12-2015

Once files are indexed then data remains in Splunk until it ages out. You no longer need the source file.

---
If this reply helps you, Karma would be appreciated.

Removing files in a monitored directory

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Join the Conversation