topic Re: Permanently delete events from an index in Getting Data In

Permanently delete events from an index

marziaolla — Thu, 21 Dec 2017 18:12:13 GMT

hi,
i want to delete from an index only the events i dont need.

i know that the delete command only hide events from the search but it doesnt delete them permanently, i want to save index space to not exceed my license.

how can i do this? can i do this from CLI?

Re: Permanently delete events from an index

harsmarvania57 — Thu, 21 Dec 2017 18:22:34 GMT

Hi,

Index space does not have any relation with Splunk license. Splunk license calculates based on daily data ingestion. So if you do not want to free up space on disk then you can use delete command otherwise there will be option to clean whole index which will remove all data from your index.

Re: Permanently delete events from an index

marziaolla — Thu, 21 Dec 2017 18:40:36 GMT

[edit] i want to reduce the volume of indexed data.

Re: Permanently delete events from an index

ChrisG — Thu, 21 Dec 2017 18:49:33 GMT

harsmarvania57 has a very good point, which is that data stored in the index does not affect your license capacity. Quoting from the Admin Manual: "Splunk Enterprise licenses specify how much data you can index per calendar day (from midnight to midnight by the clock on the license master)."

Here are two documentation topics that might help you: