Refine your search:

How I can I remove specfic indexed data from an exsiting data index?

asked 30 Apr '10, 16:43

clyde772's gravatar image

clyde772
413171341
accept rate: 0%


2 Answers:
link

answered 30 Apr '10, 16:47

rroberts's gravatar image

rroberts
2.1k1223
accept rate: 44%

You can delete specific indexed data using the delete command. So in your case, you might do:

sourcetype=my_sourcetype | delete

Note that you will need to have the can_delete role and that this process is irreversible. This will NOT create disk space.

link

answered 30 Apr '10, 17:33

Simeon's gravatar image

Simeon ♦
4.4k131539
accept rate: 27%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×2,723

Asked: 30 Apr '10, 16:43

Seen: 8,685 times

Last updated: 30 Apr '10, 17:33

Copyright © 2005-2014 Splunk Inc. All rights reserved.