https://community.splunk.com/t5/Splunk-Search/How-do-I-remove-indexed-data-Such-as-specific-data-source/m-p/12673#M1053 <P>Check out <A href="http://www.splunk.com/base/Documentation/4.1.1/Admin/RemovedatafromSplunk" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.1/Admin/RemovedatafromSplunk</A></P> Fri, 30 Apr 2010 23:47:32 GMT rroberts 2010-04-30T23:47:32Z https://community.splunk.com/t5/Splunk-Search/How-do-I-remove-indexed-data-Such-as-specific-data-source/m-p/12672#M1052 <P>How I can I remove specfic indexed data from an exsiting data index?</P> Fri, 30 Apr 2010 23:43:10 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-remove-indexed-data-Such-as-specific-data-source/m-p/12672#M1052 clyde772 2010-04-30T23:43:10Z https://community.splunk.com/t5/Splunk-Search/How-do-I-remove-indexed-data-Such-as-specific-data-source/m-p/12673#M1053 <P>Check out <A href="http://www.splunk.com/base/Documentation/4.1.1/Admin/RemovedatafromSplunk" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.1/Admin/RemovedatafromSplunk</A></P> Fri, 30 Apr 2010 23:47:32 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-remove-indexed-data-Such-as-specific-data-source/m-p/12673#M1053 rroberts 2010-04-30T23:47:32Z https://community.splunk.com/t5/Splunk-Search/How-do-I-remove-indexed-data-Such-as-specific-data-source/m-p/12674#M1054 <P>You can delete specific indexed data using the delete command. So in your case, you might do:</P> <P>sourcetype=my_sourcetype | delete</P> <P>Note that you will need to have the can_delete role and that this process is irreversible. This will NOT create disk space.</P> Sat, 01 May 2010 00:33:43 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-remove-indexed-data-Such-as-specific-data-source/m-p/12674#M1054 Simeon 2010-05-01T00:33:43Z