topic Re: delete input files in Getting Data In

delete input files

pjmenon — Mon, 21 Jun 2010 23:16:22 GMT

I am trying to remove unwanted input source files. Tried clean command

Stop splunk splunk clean filename

Does not work. Am I doing something wrong here?

Re: delete input files

Simeon — Mon, 21 Jun 2010 23:36:27 GMT

Please clarify the question... Are you trying to delete data from the index, or are you trying to delete the input itself?

Re: delete input files

Simeon — Tue, 22 Jun 2010 00:00:58 GMT

You can selectively delete events via keyword searches by using the delete command:

http://www.splunk.com/base/Documentation/latest/SearchReference/Delete

Re: delete input files

pjmenon — Tue, 22 Jun 2010 01:49:39 GMT

I want to delete the entire data and wipe it out completely. My understanding is that Delete command will hide data but it does not remove the data permanently.

Re: delete input files

pjmenon — Tue, 22 Jun 2010 02:24:01 GMT

Both. Not sure if it matters, but it is a stand-alone file.

Re: delete input files

Genti — Tue, 20 Jul 2010 03:49:30 GMT

is this data in a certain index? is there any other data in this index that you do not want to delete?
Then there really is no easyer way to do this. Using the | delete command would be the best choice, and once data rolls to frozen it will then completely get deleted.

Otherwise if you do not care for the data on a certain index you can use the ./splunk delete eventdata
(note, all data in that index will be removed).

To remove the file from being indexed again go to your manager page and head to:
Manager » Data inputs » Files & Directories
then disable the file that you do not want to index anymore.

Hope this helps,
.gz

Re: delete input files

bwili — Fri, 26 Aug 2011 17:36:21 GMT

This works for me:

source= | delete

Your user would of course need 'can delete' privs.