Getting Data In

Deletion of indexed logs

attgjh1
Communicator

if i use "| delete"

the data are still stored in the indexers. is there anyway to physically remove them?

Tags (2)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

sdaniels
Splunk Employee
Splunk Employee

http://docs.splunk.com/Documentation/Splunk/latest/admin/RemovedatafromSplunk

Example

./splunk clean eventdata -index yourindex

Ayn
Legend

DANGER - I hope you realize that performing a clean eventdata removes ALL events from the index. I know it's fairly obvious from both the command name and the description in the docs, but it's worth repeating.

If you use the delete operator there is no way to physically remove the events, they will however be removed when cold buckets are moved to frozen.

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Yes...command prompt. Those are linux examples. Go to to /bin and run

splunk clean eventdata -index yourindex

0 Karma

attgjh1
Communicator

thanks for quick reply.

i dont quite understand how to use CLI in splunk. im doing everything using websplunk only. currently my data are all local on a pc.

so, just to clarify...
CLI is only accessible via Command prompt on windows.
And then going to the directory $SPLUNKHOME/bin/

then doing the steps shown in ur link?

many thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...