topic Re: how to delete uploaded csv file in Knowledge Management

how to delete uploaded csv file

syjayaraj — Sat, 20 Feb 2016 17:56:58 GMT

Hello Team,
I added an csv file using add data, I do not know how to delete it, could some help on this.
and where this normally sits .i.e the path e.g opt/splunk..

Re: how to delete uploaded csv file

martin_mueller — Sat, 20 Feb 2016 20:33:26 GMT

You've probably uploaded a lookup .csv file, those sit in $SPLUNK_HOME/etc/apps/your_app/lookups or $SPLUNK_HOME/etc/system/lookups.

Re: how to delete uploaded csv file

ngatchasandra — Tue, 29 Sep 2020 08:53:43 GMT

Hi syjayaraj,

remove your csv file returns to delete the data therein. In the search bar, you can use delete operator .

To do this, your role must have the capability to do so. If you are an admin user, you must go add can_delete role because admin role don't have it by default.

After to this, run a search that returns events of your csv file like follow:

source=   (name_of_your_file.csv)  OR (Path/../ name_of_your_file.csv)|delete

This will remonve all data in your csv file

For more Explanation follow the link:

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk#Delete_events_from_future_searches

I think that to see where your csv file is located, go to opt/Splunk/var/lib/splunk/defaultdb/db/hot_v1_0/rawdata if you use default index to index your file.

Note: hot_v1_0 is newsly created directory.

follow opt/Splunk/var/lib/splunk/your_index_nama/db/hot_v1_0/rawdata for for your particular index.

Re: how to delete uploaded csv file

dkeck — Tue, 23 Feb 2016 10:54:20 GMT

Hi,

you can also just delete the index you put the data in, assumed its the only data in this index otherwise thats not a help.

Settings->Indexes->delete

Re: how to delete uploaded csv file

fdi01 — Tue, 23 Feb 2016 12:47:10 GMT

in CLI; go to splunk_home/bin/ use splunk clean command to do it
you can first run splunk help clean command to understand how clean command is it work

Re: how to delete uploaded csv file

hsesterhenn_spl — Thu, 25 Feb 2016 17:44:38 GMT

Please do not remove files from the bucket if you are not familiar with Splunk internal details.

If you want to delete data use the official commands (Splunk clean on the CLI) or delete the whole index.

Holger

Re: how to delete uploaded csv file

hsesterhenn_spl — Thu, 25 Feb 2016 17:53:48 GMT

Hi,

let's summarize your options:

If you have uploaded a CSV using "Add Data" all events are copied from the CSV into an index (this is the main index by default if you don't change it). There is no thing as "stored CSV file". This file has been removed from the system after adding the events.
Using the "source=" search filter you can get all events which have been imported from this CSV.

If you want to delete a whole index use "splunk clean eventdata" on the CLI as mentioned. It will free the space on disk.

The "delete" command is only allowed for a special role as mentioned AND IT WILL NOT DELETE DATA FROM DISK!
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk#How_to_delete
Please read this explanation carefully.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete

And as mentioned by Martin if you have uploaded a file to be used as a LOOKUP you have to delete it from the server itself.

HTH,
Holger