topic Re: How do you delete old data from an index? in Getting Data In

How do you delete old data from an index?

christianubeda — Mon, 14 Jan 2019 17:59:42 GMT

Hi team!

I am a beginner and I need help.

I did an index. This Index imported all information from a CSV.

The problem is I have repeat information in the index because every time it imports information, it stores all data.

This CSV has IPs, and because of this, I have repeat IPs...

How can I refresh my index and delete old data? I need to import all IPs, not only those that change.

Thank you a lot.

Re: How do you delete old data from an index?

ChrisG — Mon, 14 Jan 2019 19:13:41 GMT

You are looking for Remove indexes and indexed data in the Managing Indexers and Clusters of Indexers manual.

Re: How do you delete old data from an index?

woodcock — Mon, 14 Jan 2019 20:42:52 GMT

I know that you probably need more information than this but this is the only part of what you wrote that I can understand. You have 2 ways to delete data from Splunk:

1: Create a search that shows the data to delete and then add | delete to the end of that search. You may need to run this as user admin and add the can_delete capability to that user.
2: Run the clean eventdata command (google it) on that index. You must stop splunk to run this.

Re: How do you delete old data from an index?

Vijeta — Mon, 14 Jan 2019 20:58:55 GMT

you can delete data from your index if you have can_delete role, but not needed unless you can't do without it.

index=<yourindexname>|delete

You need to be very careful with this approach as data deletion will lead to empty searches till the time new lookup is indexed.

Thanks

Re: How do you delete old data from an index?

ManchitMalik — Tue, 15 Jan 2019 07:54:36 GMT

You have 2 ways-
1. Use clean command in CLI - splunk clean eventdata -index ** , it will delete the indexed data permanently.
2. Use delete command in Splunk Web- **index= | delete , it will make your data non searchable from this particular index.