https://community.splunk.com/t5/Getting-Data-In/How-to-remove-sources-from-disk-via-CLI/m-p/119447#M24839 <P>Hello,</P> <P>We’re looking to remove data from one of our indexes, preferably using the clean operator from the CLI.</P> <P>We have the some sources like “Perfmon:CPU Load” and “WinEventLog:System” – What would the correct clean syntax be to remove these sources from disk in the CLI be please?</P> <P>Thanks</P> Wed, 19 Nov 2014 13:15:56 GMT Benlavender 2014-11-19T13:15:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-sources-from-disk-via-CLI/m-p/119447#M24839 <P>Hello,</P> <P>We’re looking to remove data from one of our indexes, preferably using the clean operator from the CLI.</P> <P>We have the some sources like “Perfmon:CPU Load” and “WinEventLog:System” – What would the correct clean syntax be to remove these sources from disk in the CLI be please?</P> <P>Thanks</P> Wed, 19 Nov 2014 13:15:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-sources-from-disk-via-CLI/m-p/119447#M24839 Benlavender 2014-11-19T13:15:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-sources-from-disk-via-CLI/m-p/119448#M24840 <P>There is no way to remove selectively data from a bucket/index.<BR /> you can only hide it using the "|delete" command<BR /> or delete all data with the "clean" command</P> Wed, 19 Nov 2014 16:07:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-sources-from-disk-via-CLI/m-p/119448#M24840 yannK 2014-11-19T16:07:21Z