Getting Data In

Source Types

nikhilmehra79
Path Finder

I see 7 source types much of them are coming from my universal fwder in which i configured 7 logs files to send seperate source data, i removed 4 of them. Now the source is not updating the event data but at sources entry on Splunk UI still shows me 7 entries...how can i get rid of both the logged/indexed data in splunk database and the 3 log files (on UI) which is not getting updated for some time now.

Tags (2)
0 Karma
1 Solution

aholzer
Motivator

To get rid of already indexed data use the "delete" command. Go here for more info on delete: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete

Using this command is irreversable so be very careful. You'll have to assign the "can_delete" role to yourself before you are allowed to perform the delete command.

Hope this helps.

View solution in original post

aholzer
Motivator

To get rid of already indexed data use the "delete" command. Go here for more info on delete: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete

Using this command is irreversable so be very careful. You'll have to assign the "can_delete" role to yourself before you are allowed to perform the delete command.

Hope this helps.

linu1988
Champion

But you can't delete the metadata .It will keep showing you 7 source/sourcetype after the delete command also. it only hides the data , doesn't even free up the disk space.

0 Karma

nikhilmehra79
Path Finder

ok make sense it answered my question

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...