https://community.splunk.com/t5/Splunk-Enterprise/Delete-old-logs-and-personal-data-of-former-employee/m-p/613272#M13927 <P>Data indexed in Splunk cannot be deleted selectively.&nbsp; It will remain in the index until it ages out or is removed to make room for new data.</P><P>You can, however, hide the data so it never appears in search results.&nbsp; To do that, you'll have to grant someone the <FONT face="courier new,courier">can_delete</FONT> role.&nbsp; Then that person will have to craft a Splunk query that finds the employee's data.&nbsp; Once satisfied with that search, add <FONT face="courier new,courier">| delete</FONT> on the end of the query to mark the events as invisible.</P> Thu, 15 Sep 2022 16:49:48 GMT richgalloway 2022-09-15T16:49:48Z https://community.splunk.com/t5/Splunk-Enterprise/Delete-old-logs-and-personal-data-of-former-employee/m-p/613269#M13926 <P>In a nutshell AZ T rade received a request to delete some personal data from a former contractor. we have to delete data linked to ****(employee name) older than a year.&nbsp;</P> <P>In which it is necessary to delete data and logs dating back more than a year concerning ****(Employee name).</P> <P>How can we do that to delte old personal data and logs dating back more than a year of an ex-employee?</P> <P>&nbsp;</P> Thu, 15 Sep 2022 16:56:04 GMT https://community.splunk.com/t5/Splunk-Enterprise/Delete-old-logs-and-personal-data-of-former-employee/m-p/613269#M13926 ashiq1993 2022-09-15T16:56:04Z https://community.splunk.com/t5/Splunk-Enterprise/Delete-old-logs-and-personal-data-of-former-employee/m-p/613272#M13927 <P>Data indexed in Splunk cannot be deleted selectively.&nbsp; It will remain in the index until it ages out or is removed to make room for new data.</P><P>You can, however, hide the data so it never appears in search results.&nbsp; To do that, you'll have to grant someone the <FONT face="courier new,courier">can_delete</FONT> role.&nbsp; Then that person will have to craft a Splunk query that finds the employee's data.&nbsp; Once satisfied with that search, add <FONT face="courier new,courier">| delete</FONT> on the end of the query to mark the events as invisible.</P> Thu, 15 Sep 2022 16:49:48 GMT https://community.splunk.com/t5/Splunk-Enterprise/Delete-old-logs-and-personal-data-of-former-employee/m-p/613272#M13927 richgalloway 2022-09-15T16:49:48Z