Solved: Removing files in a monitored directory

michael_lee · ‎05-12-2015

hi,
I have a monitored directory that is indexed by splunk. I tried removing the files in the directory after they are indexed. Restarted the splunk daemon and I still see the file contents when searched. My question is, can I confirm that I can safely remove those files in that directory that are already indexed without any other consequences ?
thanks

richgalloway · ‎05-12-2015

Once files are indexed then data remains in Splunk until it ages out. You no longer need the source file.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎05-12-2015

Once files are indexed then data remains in Splunk until it ages out. You no longer need the source file.

---
If this reply helps you, Karma would be appreciated.

Removing files in a monitored directory

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Join the Final Session of the Data Management & Federation Bootcamp Series

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Join the Conversation