topic Re: index duplication in Splunk Enterprise

index duplication

code_nomad — Fri, 02 Nov 2012 11:14:07 GMT

is there any way to delete/remove indexed data for a particular time range ? thanks in advance.

Re: index duplication

MHibbin — Fri, 02 Nov 2012 11:36:16 GMT

You can filter you indexes to the events you wish to remove in the standard Splunk search view (i.e. flashtimeline). For example:

 <your filtering search> | delete

As this is "risky", the user will need to be assigned the "can_delete" role.

If it is in specific indexes, and you wish to remove that WHOLE index, you can use the CLI tool, "clean", to delete data from that Index. For example

./splunk clean eventdata ...

These methods should be used with extreme caution as the effects can not be reversed. I would recommend reviewing your filtering search carefully, and also reading the documenatation on this subject first... it should not be taken lightly.

http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/RemovedatafromSplunk

Re: index duplication

code_nomad — Fri, 02 Nov 2012 12:09:51 GMT

thank you !!

Re: index duplication

MHibbin — Fri, 02 Nov 2012 12:18:40 GMT

no problem... if this answers your question, can you please mark it as accepted to "close" it off.

Re: index duplication

MHibbin — Fri, 02 Nov 2012 12:19:10 GMT

... it's the empty tick next to the answer

Re: index duplication

piebob — Thu, 27 Dec 2012 21:59:54 GMT

(i accepted your answer, mhibbin :))