topic Re: Splunk clean eventdata to an extent in Getting Data In

Splunk clean eventdata to an extent

Ant1D — Thu, 04 Oct 2012 09:25:25 GMT

Hi,

I am aware that you can permanently erase data from an index by typing the following command via CLI: splunk clean eventdata the_index

This would erase ALL data from the_index.

If I wanted to erase all events from the_index that were indexed on a particular date (e.g. 1st October 2012), how would I do this?

Thanks in advance for your help.

Re: Splunk clean eventdata to an extent

Ayn — Thu, 04 Oct 2012 09:59:32 GMT

The answer is you can't selectively delete data like that. You can use the delete command, which will "delete" data from a Splunk user perspective, but what it will really do is just mark the data as "deleted" rather than actually erasing it, so you won't free up any disk that way.

Re: Splunk clean eventdata to an extent

Ant1D — Thu, 04 Oct 2012 10:14:18 GMT

Hmmm, that's not great. If I "delete" the data, can this action be reversed? Also, how do I "delete" data? Doing a full clean of an index is not an option. Splunk Devs...if you are watching, the above would be a useful addition 😉

Re: Splunk clean eventdata to an extent

Ayn — Thu, 04 Oct 2012 10:47:02 GMT

Deleted data cannot be undeleted. You can delete data using the delete command, the docs has info on it here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete

Re: Splunk clean eventdata to an extent

Ant1D — Thu, 04 Oct 2012 11:22:50 GMT

Ok I will check it out. Thanks. One last thing, is there any way of selectively erasing data?

Re: Splunk clean eventdata to an extent

Ayn — Thu, 04 Oct 2012 11:29:07 GMT

No, there is not, apart from the retention settings which will erase data based on its age.

Re: Splunk clean eventdata to an extent

Ant1D — Thu, 04 Oct 2012 12:10:23 GMT

OK, thanks for your feedback.