Getting Data In

Deletion of indexed logs

attgjh1
Communicator

if i use "| delete"

the data are still stored in the indexers. is there anyway to physically remove them?

Tags (2)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

sdaniels
Splunk Employee
Splunk Employee

http://docs.splunk.com/Documentation/Splunk/latest/admin/RemovedatafromSplunk

Example

./splunk clean eventdata -index yourindex

Ayn
Legend

DANGER - I hope you realize that performing a clean eventdata removes ALL events from the index. I know it's fairly obvious from both the command name and the description in the docs, but it's worth repeating.

If you use the delete operator there is no way to physically remove the events, they will however be removed when cold buckets are moved to frozen.

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Yes...command prompt. Those are linux examples. Go to to /bin and run

splunk clean eventdata -index yourindex

0 Karma

attgjh1
Communicator

thanks for quick reply.

i dont quite understand how to use CLI in splunk. im doing everything using websplunk only. currently my data are all local on a pc.

so, just to clarify...
CLI is only accessible via Command prompt on windows.
And then going to the directory $SPLUNKHOME/bin/

then doing the steps shown in ur link?

many thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...