Does Splunk persist data?

[sharat_cwc]

Hi,
I would like to know if Splunk will fetch results from source files that are removed either from their location on the server or deleted as one of the sources for Splunk.

In other words, once Splunk is fed the source files, it decouples from the source file after parsing and indexing the data?

Thank you

[lukejadamec]

Yes, sort of.

Once the data is indexed, it will be searchable from splunk. It does not matter what happens to the source file after that.

If you are monitoring a source, then splunk will continue to look for that source, but if there is nothing there then it won't find anything.