am monitoring the one log file in splunk by declaring the bleow stanza in inputs.conf file.but the problem is whenever i added an event to that log file then its updating( means that event available in splunk search),but if i deleted any event in that log file even though still that event is avaliable in splunk search searched data.what is the reason plz help me.
**[monitor://D:\3D Count\access]
disabled = false
index = log_review
sourcetype = access_combined**
↧