Knowledge Management

How to delete events from a summary-index?

gcusello
SplunkTrust
SplunkTrust

Hi,

Is it possible to delete some events (not the full index) from a summary index?
something like | delete command?

Thank you.
Giuseppe

1 Solution

vasanthmss
Motivator

Hi cusello,

Yes you can delete the events using | delete command, make sure that you are adding the pipe right after your base search. Here are the delete command description and the link,

Description

Makes events irretrievable from the Splunk Enterprise indexes.
Caution: Removing data is irreversible. If you want to get your data back after the data is deleted, you must re-index the applicable data sources.

Ref: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete

Hope this will helps you.

Thanks,
V

V

View solution in original post

vasanthmss
Motivator

Hi cusello,

Yes you can delete the events using | delete command, make sure that you are adding the pipe right after your base search. Here are the delete command description and the link,

Description

Makes events irretrievable from the Splunk Enterprise indexes.
Caution: Removing data is irreversible. If you want to get your data back after the data is deleted, you must re-index the applicable data sources.

Ref: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete

Hope this will helps you.

Thanks,
V

V

woodcock
Esteemed Legend

You may not have permission to use the delete command.

Adan12345
Explorer

How is "delete" permissions granted to an individual users?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Excuse me, but I probably misspoke!
My problem is that I loaded wrong events in a tsidx index using the tscollect command (BlueCoat App) and now I don't know how to delete them because I cannot use the "| delete" command after a non-streaming command 'tstats'.
How can I search events loaded in a tsidx index and delete them?
Thank you.
Bye.
Giuseppe

0 Karma

vasanthmss
Motivator

Post your search

V
0 Karma

gcusello
SplunkTrust
SplunkTrust

The load search is:

`bcoat_request`| rex field=source "(?(Proxy|Users)_.*)" | table _time action bytes_in bytes_out category cs_uri_path cs_uri_scheme cs_uri_extension dest_host filter_result http_content_type http_referrer http_user_agent sc_status src_ip src_user x_bluecoat_application_name x_virus_id dvc_ip proxysource | tscollect namespace=bluecoat_stats

It's the Splunk App for BlueCoat standard load search, the only difference is that I extract an additional field ( proxysource ).
Thank you.
Bye.
Giuseppe

0 Karma

vasanthmss
Motivator

Perfect point.

V
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...