I've tried to delete events for a particular source,say source="tcp:1234" | delete
The operation was successful.However after I returned to the search summary page, there are events still listed with that source..
When I clicked on it, it takes me to search page but indicate '0 matching events'.
Is it a bug?
The "delete" command doesn't really delete the events from the index: it marks them so that they are not displayed anymore as search results. Unluckily right now, the index metadata are not updated, so those events are still presents in the summary page.
The only way to phisically erase events is to clean-up the index but that is not selective.
Thanks. I've noticed it takes a while for the events to be displayed as '0'. Are we able to or is it safe enough to remove those '0' entries from Hosts.data,SourceType.data, Sources.data ?
Thanks. I've noticed it takes a while for the events to be displayed as '0'. Are we able to or is it safe enough to remove those '0' entries from Hosts.data,SourceType.data, Sources.data ?
You should not under usual circumstances edit those files by hand. They will be updated by Splunk automatically.
The "delete" command doesn't really delete the events from the index: it marks them so that they are not displayed anymore as search results. Unluckily right now, the index metadata are not updated, so those events are still presents in the summary page.
The only way to phisically erase events is to clean-up the index but that is not selective.
Other (much more complicated and often infeasible) options are to export selectively, and reimport, or to drop and re-index data from either an original source or a partial export. There are no general instructions because the ability to do this is specific to you situation.