About MS23

richgalloway · ‎03-08-2023

It's not clear to me what it is you wish to delete. There is no uploaded file on Splunk so there's nothing to delete. The original file on your workstation is not touched, other than to read it. Once the data is ingested, you can safely delete the original data. If you want Splunk to automatically delete a monitored file after it has been indexed, use a batch input. See https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Inputsconf#:~:text=setting%20also%20exists.-,BATCH,-(%22Upload%20a%20file for details.

richgalloway · ‎03-07-2023

The rephrasing seems the same as the original so I'm sticking with my original answer.

ITWhisperer · ‎03-07-2023

It sounds like you need the application team to explain what the logs mean and where you can extract the information from the logs that you are interested in. If it isn't already in the logs, then there may be some development work required by the application team to make it present in the logs. Ideally, you need to understand the data you are dealing with.

Posts	6
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎03-06-2023

Online Status	Offline
Date Last Visited	‎03-07-2023 05:38 AM

How to delete the uploaded log file?

How to add API name in splunk logs

How to write new requirements for refining Splunk ...

Re: How to delete the uploaded log file?

Re: How to write new requirements for refining Spl...

Re: How to add API name in splunk logs

Are you a member of the Splunk Community?