monitoring log file in splunk

[Umesh_Vedicsoft]

am monitoring the one log file in splunk by declaring the bleow stanza in inputs.conf file.but the problem is whenever i added an event to that log file then its updating( means that event available in splunk search),but if i deleted any event in that log file even though still that event is avaliable in splunk search searched data.what is the reason plz help me.

[monitor://D:\3D Count\access]
disabled = false
index = log_review
sourcetype = access_combined

[Jeremiah]

When Splunk indexes your log file, it makes a copy of the log data and stores it locally on your splunk server in its index. When you run a search in Splunk, it is not accessing the original log file at all; it is searching its own local copy. Modifying your log file after data has been indexed will not affect what is visible in Splunk. If you want to remove data from Splunk, you'll need to use either the delete or clean index commands. Be extremely careful if you are working on a production server.

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk

[Umesh_Vedicsoft]

hello Jeremiah
thanks for your reply, as per your words I came to know that data is monitoring from local file not from original one but if i inserted new record in original file it is reflecting in splunk, at the same time if I delete the record why it not reflecting in splunk.

[Jeremiah]

The file is not "synchronized" with Splunk in the way you are describing. Once Splunk has seen a log entry in the file, it retains it, regardless if you delete a log entry or the entire original log file. This is by design, logs by definition should be append only, and are usually rotated off of a server after some period of time.

[Umesh_Vedicsoft]

i am using 6.4.0 version