topic Re: How do I delete events? in Getting Data In

How do I delete events?

the_wolverine — Sat, 17 Apr 2010 04:13:38 GMT

I have some data in my index that I don't want. How can I get rid of them?

the_wolverine — Sat, 17 Apr 2010 04:19:08 GMT

You can search for your unwanted events and then pipe them to delete. For example:

sourcetype=wantedsource | delete

It's a good idea to search for your events first and confirm that these events are the correct events.

Important notes:

The user running this command must have the delete capability or be assigned the can_delete role.
This command does not reclaim disk space. It merely masks the deleted events so that they are not returned as part of search results. To reclaim disk space, you need to clean the index -- if all of your unwanted data is in one index then you can simply clean that index. Or, set an automatic archival policy to, eventually, expire your data automatically but then you'll have wait for the trigger (size or age.)

tpaulsen — Tue, 31 Jan 2012 12:00:43 GMT

Will the deleted masked events age out as well?

dmaislin_splunk — Tue, 31 Jan 2012 12:08:23 GMT

FYI: You can only run the | delete command if you add the can_delete option in the role of the user.

tpaulsen — Tue, 31 Jan 2012 12:50:29 GMT

Yes, that´s what was stated in the original answer already.