topic Re: How to delete data in an index from a certain host? in Getting Data In

How to delete data in an index from a certain host?

PIETRO_CENTANNI — Tue, 16 Feb 2016 12:45:28 GMT

I have a need to save space on an indexer server.

In the main index, I have a data from a host that is not used and I would like to delete all of its data from the index.

How can I delete data only from this host without deleting everything in the main index? I want to delete the data, not hide it.

Thanks

Re: How to delete data in an index from a certain host?

klsio — Tue, 16 Feb 2016 12:53:43 GMT

Using this command.

index='foo' | delete

Re: How to delete data in an index from a certain host?

fdi01 — Tue, 16 Feb 2016 12:57:26 GMT

use clean command in splunk to do it.
from splunk_home/splunk/bin/ repertory in CLI,
run ./splunk help clean to understans how clean command work.
like this :

./splunk clean eventdata -index  your_index_name -f

Re: How to delete data in an index from a certain host?

renjith_nair — Tue, 16 Feb 2016 13:13:47 GMT

Hello @PIETRO_CENTANNI ,

Unfortunately, "splunk clean" is unable to delete specific data from index. It's all-or-nothing : The entire index has to be wiped, or none of it.
Instead you can set the retention period in Splunk for the particular index and delete old events to free up some space (frozenTimePeriodInSecs).

See
http://docs.splunk.com/Documentation/Splunk/6.0.2/Indexer/Setaretirementandarchivingpolicy
https://wiki.splunk.com/Deploy:BucketRotationAndRetention

Re: How to delete data in an index from a certain host?

PIETRO_CENTANNI — Tue, 16 Feb 2016 13:21:21 GMT

I have already a policy retention the I can't modify.
So the unique solution is add space.

Thank you and have a nice day

Re: How to delete data in an index from a certain host?

woodcock — Tue, 16 Feb 2016 15:48:50 GMT

This command does not actually delete anything; it just hides it. Therefore, there is no impact upon disk space.

Re: How to delete data in an index from a certain host?

klsio — Tue, 16 Feb 2016 17:10:04 GMT

ah.. thank you 🙂

Re: How to delete data in an index from a certain host?

PIETRO_CENTANNI — Wed, 17 Feb 2016 08:23:14 GMT

This command delete all index. I have need delete a single host from index.