topic Re: How do I remove a source? in Knowledge Management

How do I remove a source?

yuanqi — Fri, 21 Sep 2012 22:41:24 GMT

I added a test file as source and couldn't figure out a way to remove it anymore. I even deleted the file and restarted Splunk. No luck.
Any suggestion?

Thanks!

Re: How do I remove a source?

kristian_kolb — Fri, 21 Sep 2012 23:14:53 GMT

You can either clean out the whole index, i.e. delete everything that you've already added to the index in question. To do this,

     stop splunk
     splunk clean eventdata -index your_index
     restart splunk

you can pipe specific search results to 'delete', i.e. you will never see them again, but the operation won't free up any used disk space. This requires that you have admin privileges and add can_delete to your role.

See the documentation for further guidance.

hope this helps,

Kristian

Re: How do I remove a source?

yuanqi — Fri, 21 Sep 2012 23:21:48 GMT

I tried the second approach and it works.
Thanks!