Solved: Removing files in a monitored directory

michael_lee · ‎05-12-2015

hi,
I have a monitored directory that is indexed by splunk. I tried removing the files in the directory after they are indexed. Restarted the splunk daemon and I still see the file contents when searched. My question is, can I confirm that I can safely remove those files in that directory that are already indexed without any other consequences ?
thanks

richgalloway · ‎05-12-2015

Once files are indexed then data remains in Splunk until it ages out. You no longer need the source file.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎05-12-2015

Once files are indexed then data remains in Splunk until it ages out. You no longer need the source file.

---
If this reply helps you, Karma would be appreciated.

Removing files in a monitored directory

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation