topic Re: How do I delete a specific data input & its relating indexed events? in Getting Data In

How do I delete a specific data input & its relating indexed events?

sthao — Wed, 20 Apr 2011 19:12:40 GMT

I have multiple data inputs going into one index. Is there a way to delete only one of those data inputs and scrub its relating events from the Events Indexed total?

I am aware of the clean command line approach, but it appears to limit me to eliminating the whole Event Index total or eliminating indexes only.

Thanks for any assistance!

Re: How do I delete a specific data input & its relating indexed events?

RicoSuave — Wed, 20 Apr 2011 19:48:19 GMT

I believe you can use the | delete command. This is assuming you have the can delete role.
For example, when i want to delete all events from one source within an index i do

source= | delete

you should be able to also do

index= sourcetype= | delete

Re: How do I delete a specific data input & its relating indexed events?

sthao — Wed, 20 Apr 2011 20:53:01 GMT

Genius! This worked for me Joetron!

One thing to note for others viewing this is that I had my data input pointing to a server location and so it ended up looking like this in the Search line, while I used the | delete command:

source="\\\\servername\\dir*" | delete

Interesting how I had to add an extra backslash for each backslash used. But it worked!

Re: How do I delete a specific data input & its relating indexed events?

traugust — Fri, 06 Jul 2012 11:25:33 GMT

One thing to mention here is that the delete oeration does NOT free the disk space occupied by that particular events, It only makes the invisible to splunk queries.