Getting Data In

How do I delete a specific data input & its relating indexed events?

sthao
New Member

I have multiple data inputs going into one index. Is there a way to delete only one of those data inputs and scrub its relating events from the Events Indexed total?

I am aware of the clean command line approach, but it appears to limit me to eliminating the whole Event Index total or eliminating indexes only.

Thanks for any assistance!

0 Karma
1 Solution

RicoSuave
Builder

I believe you can use the | delete command. This is assuming you have the can delete role.
For example, when i want to delete all events from one source within an index i do

source= | delete

you should be able to also do

index= sourcetype= | delete

View solution in original post

RicoSuave
Builder

I believe you can use the | delete command. This is assuming you have the can delete role.
For example, when i want to delete all events from one source within an index i do

source= | delete

you should be able to also do

index= sourcetype= | delete

traugust
Explorer

One thing to mention here is that the delete oeration does NOT free the disk space occupied by that particular events, It only makes the invisible to splunk queries.

0 Karma

sthao
New Member

Genius! This worked for me Joetron!

One thing to note for others viewing this is that I had my data input pointing to a server location and so it ended up looking like this in the Search line, while I used the | delete command:

source="\\\\servername\\dir*" | delete

Interesting how I had to add an extra backslash for each backslash used. But it worked!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...