https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148521#M30216 <P>You won't able to delete partial data once data is indexed. Either you have to clean index data or follow above recommendation. </P> Mon, 23 Feb 2015 07:32:04 GMT satishsdange 2015-02-23T07:32:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148518#M30213 <P>Hi, </P> <P>I have two sourcetypes forwarded to an index, but I just want to delete one of the sourcetypes from this index. What is the approach? thks</P> Mon, 23 Feb 2015 06:51:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148518#M30213 newbiesplunk 2015-02-23T06:51:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148519#M30214 <P>use this search</P> <P>index=indexname sourcetype=sourecetypename|delete</P> <P>this will not delete the data from the sourcetype but you will not see any data from this sourcetype in search</P> Mon, 23 Feb 2015 07:10:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148519#M30214 kml_uvce 2015-02-23T07:10:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148520#M30215 <P>Hi, I know this search but i need to remove it permanently from the index, what will be the advise? thks</P> Mon, 23 Feb 2015 07:19:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148520#M30215 newbiesplunk 2015-02-23T07:19:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148521#M30216 <P>You won't able to delete partial data once data is indexed. Either you have to clean index data or follow above recommendation. </P> Mon, 23 Feb 2015 07:32:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148521#M30216 satishsdange 2015-02-23T07:32:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148522#M30217 <P>hi, i saw there is a rebuild index function (splunk rebuild ), can i use for my case? thks</P> Mon, 23 Feb 2015 07:44:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148522#M30217 newbiesplunk 2015-02-23T07:44:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148523#M30218 <P>When you delete the data via the | delete command, this marks the buckets as unsearchable and this data will be aged out via the retention period of the index. </P> <P>Aside from this, you need to modify your inputs to make sure that data source isnt sent to this index anymore.</P> <P>Why isnt this sufficient for your use case? Data will not be visible to user or available to search, so for all intensive purposes, the data is deleted.</P> Tue, 24 Feb 2015 03:48:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148523#M30218 esix_splunk 2015-02-24T03:48:55Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148524#M30219 <P>hi,<BR /> your index How sourcetype?<BR /> please forgive my english</P> Thu, 05 Mar 2015 13:33:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148524#M30219 gyslainlatsa 2015-03-05T13:33:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148525#M30220 <P>hi newbiesplunk ,<BR /> if your index has one sourcetype , you can remove once the index using the next command <CODE>splunk clean -index ‹indexname›</CODE></P> Thu, 05 Mar 2015 13:39:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-a-sourcetype-from-one-of-my-indexes/m-p/148525#M30220 gyslainlatsa 2015-03-05T13:39:50Z