Is this true with the latest version? 6.2? I'm not able to pipe a search into the delete. It says it's deleted but if I refresh the search the data is still there. I can't check the user roles in the free version to see if I have delete access?
This feature is available to the Admin user in the free edition as well.
You should note though that the delete
operator doesn't actually delete the log files themselves, rather it marks events in Splunk's index as deleted. Also as it only marks them as deleted rather than deleting them for real, you won't immediately recover any disk space by running delete
. Events that are marked as deleted will however be totally removed when events are moved to cold index (think of it as archiving).