Getting Data In

Deletion of indexed logs

attgjh1
Communicator

if i use "| delete"

the data are still stored in the indexers. is there anyway to physically remove them?

Tags (2)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

sdaniels
Splunk Employee
Splunk Employee

http://docs.splunk.com/Documentation/Splunk/latest/admin/RemovedatafromSplunk

Example

./splunk clean eventdata -index yourindex

Ayn
Legend

DANGER - I hope you realize that performing a clean eventdata removes ALL events from the index. I know it's fairly obvious from both the command name and the description in the docs, but it's worth repeating.

If you use the delete operator there is no way to physically remove the events, they will however be removed when cold buckets are moved to frozen.

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Yes...command prompt. Those are linux examples. Go to to /bin and run

splunk clean eventdata -index yourindex

0 Karma

attgjh1
Communicator

thanks for quick reply.

i dont quite understand how to use CLI in splunk. im doing everything using websplunk only. currently my data are all local on a pc.

so, just to clarify...
CLI is only accessible via Command prompt on windows.
And then going to the directory $SPLUNKHOME/bin/

then doing the steps shown in ur link?

many thanks!

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...