Getting Data In

Removing data from splunk by Host

jared_anderson
Path Finder

I put the universal forwarder on my computer to test splunk. Now that we have it up and running, I want to remove all data that came from my computer. Is there a way to remove data from splunk, based on host? I don't want to just hide the data by using "| delete" I want to completely remove the data.

Tags (4)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

You can completely remove the data by cleaning an index as you see in the link below. This is not something you can do by host however. The delete command will allow you to remove data by host and make in unaccessible from the UI. The indexed data still resides and takes up space on disk however until it is aged out.

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk#Remove_data_from_one...

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

You can completely remove the data by cleaning an index as you see in the link below. This is not something you can do by host however. The delete command will allow you to remove data by host and make in unaccessible from the UI. The indexed data still resides and takes up space on disk however until it is aged out.

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk#Remove_data_from_one...

jared_anderson
Path Finder

Great. That is exactly what I needed to know. I went over two days in a row, and I was just cleaning up some stuff. I uninstalled the forwarder but just wanted to clean things up. Thank you for your help.

0 Karma

sdaniels
Splunk Employee
Splunk Employee

For the current day, data that you've already ingested, yes. But you do get the ability to go over your daily license limit. If it's splunk free you have 3 times in a 30 day period, if it's a purchased license you have 5 times in 30 days. Data stored does not matter against the license other than the fact that you'll need a little more disk space to hold onto it depending on how much data you are talking about.

0 Karma

jared_anderson
Path Finder

Will this still affect the license?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...