Delete indexed event and prevent from indexed again?

nhgiang1994 — Thu, 05 Apr 2018 04:17:16 GMT

Hi,

I developing a Table dashboard with new data populated every 10 seconds using DBX. For some private reasons, I cannot use Rising Column of DBX, so there many duplicated events.

I also use Javascript to let the user to remove one or some row in the table. My current dummy strategy is:
1. Export the to-be-removed event to csv file using outputcsv command
2. Running a delete command
3. On the next refresh, compare with the csv file and eliminate the events with the same with removed event.

I must pause the dashboard refreshing to let the outputcsv complete or the removed event may re-appear because of the duplication. The problem is that outputcsv and the comparing process take very long to complete - which affect user experiences.

I want to ask if there is any neat way to mark the events as deleted and prevent it to be indexed again? Can I edit the indexed events and mark them as I wish?

Thanks

Re: Delete indexed event and prevent from indexed again?

mayurr98 — Thu, 05 Apr 2018 06:45:09 GMT

I think the best way to delete the events and prevent it t be indexed again is to send it to nullqueue.

Refer this document for more information
http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest

This will make changes in real time and future events this will not change the data which is already indexed i.e. historical events that you need to delete using | delete command.

Let me know if this helps!

topic Delete indexed event and prevent from indexed again? in Getting Data In

Delete indexed event and prevent from indexed again?

Re: Delete indexed event and prevent from indexed again?