topic Re: Source Types in Getting Data In

Source Types

nikhilmehra79 — Mon, 30 Dec 2013 06:09:26 GMT

I see 7 source types much of them are coming from my universal fwder in which i configured 7 logs files to send seperate source data, i removed 4 of them. Now the source is not updating the event data but at sources entry on Splunk UI still shows me 7 entries...how can i get rid of both the logged/indexed data in splunk database and the 3 log files (on UI) which is not getting updated for some time now.

Re: Source Types

aholzer — Mon, 30 Dec 2013 15:00:03 GMT

To get rid of already indexed data use the "delete" command. Go here for more info on delete: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete

Using this command is irreversable so be very careful. You'll have to assign the "can_delete" role to yourself before you are allowed to perform the delete command.

Hope this helps.

Re: Source Types

nikhilmehra79 — Tue, 31 Dec 2013 20:56:02 GMT

ok make sense it answered my question

Re: Source Types

linu1988 — Tue, 31 Dec 2013 21:02:48 GMT

But you can't delete the metadata .It will keep showing you 7 source/sourcetype after the delete command also. it only hides the data , doesn't even free up the disk space.