https://community.splunk.com/t5/Splunk-Search/Splunk-Logs-read-after-deleting-using-delete-command/m-p/455356#M168180 <P>Hello Splunkers,</P> <P>Lately I had to delete specific source type logs from the index and used the command |delete from the search head.<BR /> However when i navigate to the buckets and zcat the journal.gz from the raw data and write it to another file I could read the file.</P> <P>Is there any way that I could remove the specific sourcetype data from the disk itself.<BR /> Index cleaning is not an option for me as I have important logs residing in the same index.</P> <P>Regards,<BR /> Ankith</P> Tue, 24 Jul 2018 23:43:17 GMT ankithnageshshe 2018-07-24T23:43:17Z https://community.splunk.com/t5/Splunk-Search/Splunk-Logs-read-after-deleting-using-delete-command/m-p/455356#M168180 <P>Hello Splunkers,</P> <P>Lately I had to delete specific source type logs from the index and used the command |delete from the search head.<BR /> However when i navigate to the buckets and zcat the journal.gz from the raw data and write it to another file I could read the file.</P> <P>Is there any way that I could remove the specific sourcetype data from the disk itself.<BR /> Index cleaning is not an option for me as I have important logs residing in the same index.</P> <P>Regards,<BR /> Ankith</P> Tue, 24 Jul 2018 23:43:17 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Logs-read-after-deleting-using-delete-command/m-p/455356#M168180 ankithnageshshe 2018-07-24T23:43:17Z https://community.splunk.com/t5/Splunk-Search/Splunk-Logs-read-after-deleting-using-delete-command/m-p/455357#M168181 <P>Hi ankithnageshshetty,</P> <P>long answer short: no. Not by using any available Splunk commands.<BR /> And btw, the <CODE>delete</CODE> command only makes events as not searchable, but does not delete any events - see the docs <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete#Description">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete#Description</A></P> <P>cheers, MuS</P> Wed, 25 Jul 2018 00:28:46 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Logs-read-after-deleting-using-delete-command/m-p/455357#M168181 MuS 2018-07-25T00:28:46Z