Hi,
I index data on a daily basis. For indexing, I have made a monitoring path in inputs.conf, so once the file is in that path it, automatically gets indexed.
So I have made a mistake by pasting the wrong set of files in that monitoring path. Now I need to delete the particular set of files for that particular date itself.
Its urgent as we are into production right now.
Assuming you have Delete permission, search for the data you don't want and pipe it to the delete
command.
index=foo source=somefile earliest=7/22/2015 00:00:00 latest=7/22/2015 23:59:59 | delete
Add qualifiers as needed to select only the data you want to delete.
Hi rich,
I am a rookie in splunk, could you please help where should i give the above command, any specified path?? a small example may be!!
Thanks
Enter your command in the search bar of the Splunk web GUI. You'll need to update my example for your environment (index name, date, etc.).