Definitely, and I think Adonio is right: all depends what you're after. Given the circumstance you mentioned, audit.log & searches.log (if they piped the output of a search to delete) should have a record. Happy splunking! http://docs.splunk.com/Documentation/Splunk/6.5.3/Troubleshooting/WhatSplunklogsaboutitself ... View more

The monitor stanza simply tells Splunk, or the UF, where to look for logs. There might be a couple of ways to do this: 1) install the UF on your BC reporter and leverage that to pull your logs into Splunk or 2) There is a new splunkbase app called "importutil". It lets you import csv files (or any input) from an http url via the Splunk search command line and also works for ftp 3) A custom TCP connection. I'm also dropping in a link; happy Splunking! http://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Configureyourinputs ... View more