Hi,
I developing a Table dashboard with new data populated every 10 seconds using DBX. For some private reasons, I cannot use Rising Column of DBX, so there many duplicated events.
I also use Javascript to let the user to remove one or some row in the table. My current dummy strategy is:
1. Export the to-be-removed event to csv file using outputcsv
command
2. Running a delete
command
3. On the next refresh, compare with the csv file and eliminate the events with the same with removed event.
I must pause the dashboard refreshing to let the outputcsv
complete or the removed
event may re-appear because of the duplication. The problem is that outputcsv
and the comparing process take very long to complete - which affect user experiences.
I want to ask if there is any neat way to mark the events as deleted
and prevent it to be indexed again? Can I edit the indexed events and mark them as I wish?
Thanks
I think the best way to delete the events and prevent it t be indexed again is to send it to nullqueue
.
Refer this document for more information
http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Discard_specific_ev...
This will make changes in real time and future events this will not change the data which is already indexed i.e. historical events that you need to delete using | delete
command.
Let me know if this helps!
I think the best way to delete the events and prevent it t be indexed again is to send it to nullqueue
.
Refer this document for more information
http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Discard_specific_ev...
This will make changes in real time and future events this will not change the data which is already indexed i.e. historical events that you need to delete using | delete
command.
Let me know if this helps!