topic Re: How to remove recently indexed data in Getting Data In

How to remove recently indexed data

DavidHourani — Thu, 16 Jan 2014 16:48:51 GMT

Hello,

I accidently had a file indexed by placing it in a directory from which splunk inputs in the logs.Is it possible to erase the newly indexed info because it messed up all my searches ?

Can I delete some sort of file or something in order to erase recently indexed data ?

Same goes for the information that was taken into the data model, what can I do to remove or undo what i added.

Thanks,
David

Re: How to remove recently indexed data

lukejadamec — Thu, 16 Jan 2014 16:57:17 GMT

You can create a search that pull the data you want to get rid of, and ONLY the data you want to get rid of, and then add delete to the end of the search. This will not actually remove the data from the index, i.e. make the index smaller, but it will make the data unsearchable.

I recommend reading this article first:

http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete

Re: How to remove recently indexed data

DavidHourani — Thu, 16 Jan 2014 17:22:32 GMT

Cool, thank you.. now i just need to find out how to get the permission to do so cause i can't seem to use |delete even as admin

Re: How to remove recently indexed data

lukejadamec — Thu, 16 Jan 2014 17:24:54 GMT

Delete is a special feature. Go to Manager > Access Controls > Users > your user > and give yourself "Can Delete" permission under Assign to Roles.

Re: How to remove recently indexed data

DavidHourani — Thu, 16 Jan 2014 17:27:56 GMT

Found it ! thanks a lot!

wish i had points to award you 🙂

Re: How to remove recently indexed data

lukejadamec — Thu, 16 Jan 2014 18:20:54 GMT

Use the check mark to accept the answer, and it will give you 10 more points I think.

Re: How to remove recently indexed data

DavidHourani — Fri, 17 Jan 2014 08:59:54 GMT

Cool 🙂 thank you.
And one more thing, does deleting also mask the data in a data model or does this only work for indexes ?

Re: How to remove recently indexed data

sravankr96 — Wed, 22 Jun 2016 05:07:55 GMT

can u tell how to remove the data permanently not just hiding it by using delete option?
Any response will be a great help. Thanks in advance:)

Re: How to remove recently indexed data

ddrillic — Wed, 22 Jun 2016 10:56:24 GMT

Remove indexes and indexed data

speaks about it.

It says
-- To delete indexed data permanently from your disk, use the CLI clean command. This command completely deletes the data in one or all indexes, depending on whether you provide an argument.