topic Re: How to delete events from a summary-index? in Knowledge Management

How to delete events from a summary-index?

gcusello — Thu, 28 Apr 2016 14:19:01 GMT

Hi,

Is it possible to delete some events (not the full index) from a summary index?
something like | delete command?

Thank you.
Giuseppe

Re: How to delete events from a summary-index?

vasanthmss — Thu, 28 Apr 2016 17:08:37 GMT

Hi cusello,

Yes you can delete the events using | delete command, make sure that you are adding the pipe right after your base search. Here are the delete command description and the link,

Description

Makes events irretrievable from the Splunk Enterprise indexes.
Caution: Removing data is irreversible. If you want to get your data back after the data is deleted, you must re-index the applicable data sources.

Ref: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete

Hope this will helps you.

Thanks,
V

Re: How to delete events from a summary-index?

woodcock — Thu, 28 Apr 2016 17:18:19 GMT

You may not have permission to use the delete command.

Re: How to delete events from a summary-index?

vasanthmss — Thu, 28 Apr 2016 17:37:36 GMT

Perfect point.

Re: How to delete events from a summary-index?

gcusello — Fri, 29 Apr 2016 06:47:05 GMT

Excuse me, but I probably misspoke!
My problem is that I loaded wrong events in a tsidx index using the tscollect command (BlueCoat App) and now I don't know how to delete them because I cannot use the "| delete" command after a non-streaming command 'tstats'.
How can I search events loaded in a tsidx index and delete them?
Thank you.
Bye.
Giuseppe

Re: How to delete events from a summary-index?

vasanthmss — Fri, 29 Apr 2016 21:33:10 GMT

Post your search

Re: How to delete events from a summary-index?

gcusello — Mon, 02 May 2016 12:26:36 GMT

The load search is:

`bcoat_request`| rex field=source "(?(Proxy|Users)_.*)" | table _time action bytes_in bytes_out category cs_uri_path cs_uri_scheme cs_uri_extension dest_host filter_result http_content_type http_referrer http_user_agent sc_status src_ip src_user x_bluecoat_application_name x_virus_id dvc_ip proxysource | tscollect namespace=bluecoat_stats

It's the Splunk App for BlueCoat standard load search, the only difference is that I extract an additional field ( proxysource ).
Thank you.
Bye.
Giuseppe

Re: How to delete events from a summary-index?

Adan12345 — Tue, 15 Aug 2023 18:37:35 GMT

How is "delete" permissions granted to an individual users?