Delete logs from server using Splunk Universal forwarder

Question

Can Splunk Universal forwarder be used to delete logs from a particular server.

e.g. I have a universal forwarder installed on a server on which an application is running. The purpose of the UF is to send logs of this application to the splunk server for monitoring purposes. This application however has a load issue and needs log rotation to be put in place, else the server shuts down. I know there are conventional ways of setting up Log rotation, but can Splunk UF be used to delete the logs from source server and then index, instead of just copying the data and indexing it?

Please let me know if you guys need further clarification.

Answer 1

Yes. Splunk will let you execute a script via the UF (normally to collect data) but you could delete logs with it.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Getdatafromscriptedinputs#Using_a_wrapper_script