topic Re: How do we delete old data for only three files in the one index ? in Getting Data In

How do we delete old data for only three files in the one index ?

kiranpanchavat1 — Thu, 25 Nov 2021 16:02:51 GMT

we need to delete three files from the index

I have used the |delete command to clean the indexed data and it’s deleted but still its showing under the source field.

source='/var/log/splunk/syslog/******/********' | delete

Re: How do we delete old data for only three files in the one index ?

PickleRick — Thu, 25 Nov 2021 16:12:06 GMT

What do you mean by "still showing under the source field"?

Also, you know that delete doesn't physically remove the data from index files? Just marks them as inaccessible.

Re: How do we delete old data for only three files in the one index ?

gcusello — Thu, 25 Nov 2021 16:13:10 GMT

Hi @kiranpanchavat1,

the delete command makes only a logical deleting of the events but it doesn't remove the deleted events from the buckets.

If you want to fully clean an index you can use the command

./splunk clean eventdata -index <your_index>

if you want to remove all the entire buckets where the latest event exceeds a retention time, you could change the retention time for that index, wait for the deletion of old data and the set up again the the correct retention time disk.

It isn't possible to physically delete only a part of events in a bucket.

Ciao.

Giuseppe

Re: How do we delete old data for only three files in the one index ?

kiranpanchavat1 — Tue, 30 Nov 2021 11:19:17 GMT

@gcusello

See, my data is stored in one index and in that index there are so many data is storing so i need to delete only the particular files

Re: How do we delete old data for only three files in the one index ?

gcusello — Tue, 30 Nov 2021 11:27:10 GMT

Hi @kiranpanchavat1,

if you're speaking of delete an entire bucket, in Community there are some examples of deleting buckets but I didn't directly tested:

https://community.splunk.com/t5/Deployment-Architecture/How-to-manually-delete-buckets-in-cluster-peers/m-p/146106

https://community.splunk.com/t5/Deployment-Architecture/Delete-corrupt-bucket-or-down-index-in-cluster/m-p/148488

If instead you want to delete only a part of a bucket it isn't possible, you can only make a logical deletion (delete command).

Ciao.

Giuseppe

Re: How do we delete old data for only three files in the one index ?

kiranpanchavat1 — Tue, 30 Nov 2021 11:29:17 GMT

@gcusello Can you provide me the btprobe command details

Re: How do we delete old data for only three files in the one index ?

gcusello — Tue, 30 Nov 2021 11:31:12 GMT

Hi @kiranpanchavat1,

https://docs.splunk.com/Documentation/Splunk/8.2.3/Troubleshooting/CommandlinetoolsforusewithSupport#btprobe

I never used it.

Ciao.

Giuseppe