https://community.splunk.com/t5/Installation/Observations-Question-Recently-Installed-Splunk/m-p/280702#M10212 <P>Indexed data isn't for changing, so you cannot fully delete data based on some host, or change the sourcetype value for some host.</P> <P>You can empty an entire index, run this while splunk is stopped:<CODE>$SPLUNK_HOME/bin/splunk clean eventdata -index yourindex</CODE><BR /> You can mark individual events as deleted without cleaning up space, append the <CODE>delete</CODE> command to a search to mark the results as deleted - your user needs the <CODE>can_delete</CODE> role to be allowed to.</P> <P>To alleviate the impact of wrong indexing in the future, consider creating a sandbox index to first send data into, confirm its correct, and only then send data into your actual indexes.</P> Sat, 13 Feb 2016 13:28:01 GMT martin_mueller 2016-02-13T13:28:01Z https://community.splunk.com/t5/Installation/Observations-Question-Recently-Installed-Splunk/m-p/280701#M10211 <P>Hi All,</P> <P>i just recently installed splunk enterprise and having following questions.</P> <P>1.How can i delete previously indexed hosts<BR /> 2.How can i edited/deleted sources type for particular hosts</P> Sat, 13 Feb 2016 08:36:27 GMT https://community.splunk.com/t5/Installation/Observations-Question-Recently-Installed-Splunk/m-p/280701#M10211 osamamansoor 2016-02-13T08:36:27Z https://community.splunk.com/t5/Installation/Observations-Question-Recently-Installed-Splunk/m-p/280702#M10212 <P>Indexed data isn't for changing, so you cannot fully delete data based on some host, or change the sourcetype value for some host.</P> <P>You can empty an entire index, run this while splunk is stopped:<CODE>$SPLUNK_HOME/bin/splunk clean eventdata -index yourindex</CODE><BR /> You can mark individual events as deleted without cleaning up space, append the <CODE>delete</CODE> command to a search to mark the results as deleted - your user needs the <CODE>can_delete</CODE> role to be allowed to.</P> <P>To alleviate the impact of wrong indexing in the future, consider creating a sandbox index to first send data into, confirm its correct, and only then send data into your actual indexes.</P> Sat, 13 Feb 2016 13:28:01 GMT https://community.splunk.com/t5/Installation/Observations-Question-Recently-Installed-Splunk/m-p/280702#M10212 martin_mueller 2016-02-13T13:28:01Z