Splunk Search

How to delete data based on search results in 3.4.14 for Windows?

straffin
Explorer

I'd like to remove all data that matches a given search from my Splunk 3.4.14 for Windows install. I've found Windows-centric examples for earlier versions that don;t work for 3.4.14 (at http://www.splunk.com/base/Documentation/3.1.3/Admin/DeleteDataFromTheIndex) and 3.4.14-centric examples that don't work under Windows (at http://www.splunk.com/base/Documentation/3.4.14/Admin/RemoveDeleteData)

Anyone know what I need to do to delete indexed data based on search results in 3.4.14 for Windows?

Tags (3)
0 Karma

straffin
Explorer

I tried replacing the single-quotes with double-quotes...

C:\Program Files\Splunk\bin>splunk search " | oldsearch delete::sourcetype::WinRegistry"

... and it appears to be working fine.

(There was an error at the end about exceeding the maximum time limit, but it worked nonetheless.)

straffin
Explorer

Well now I feel like a total newb. 😕 After trying some other things, I had simply tried the command as listed in the 3.4.14-centric article listed above and, when it failed, I (in frustration) moved on to more searching and asking here. Just now, I tried replacing the single-quotes with double-quotes...

C:\Program Files\Splunk\bin>splunk search " | oldsearch delete::sourcetype::WinRegistry"

... and it appears to be working fine. Thanks for the encouragement to look at it again, anyway. 🙂

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Please indicate exactly what you typed in Windows, and what error you received. While http://www.splunk.com/base/Documentation/3.4.14/Admin/RemoveDeleteData#Remove_events_from_search_res... shows a non-Windows example, but the functionality will be identical, though of course as noted there you will have to correct the shell syntax (in particular directory separators and quotes) for it to work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...