https://community.splunk.com/t5/Splunk-Search/Scrub-data-from-Splunk/m-p/81426#M181864 <P>To really clean, you would have to export the data you want to keep out of the index using command line <CODE>exporttool</CODE> or <CODE>splunk export</CODE> (possibly after doing <CODE>| delete</CODE>) then import back in with <CODE>importtool</CODE> or <CODE>splunk import</CODE>.</P> Thu, 14 Apr 2011 08:38:06 GMT gkanapathy 2011-04-14T08:38:06Z https://community.splunk.com/t5/Splunk-Search/Scrub-data-from-Splunk/m-p/81424#M181862 <P>Splunk's scrub command scrub data in queries/report. What are the steps to permanently remove certain logs from Splunk? I imagine it'd require re-generating the index. </P> Thu, 14 Apr 2011 06:40:05 GMT https://community.splunk.com/t5/Splunk-Search/Scrub-data-from-Splunk/m-p/81424#M181862 qas 2011-04-14T06:40:05Z https://community.splunk.com/t5/Splunk-Search/Scrub-data-from-Splunk/m-p/81425#M181863 <P>You can take a search and <CODE>| delete</CODE> to delete the results of that search from the index. Your account needs the <CODE>can_delete</CODE> privilege. Strictly speaking, this does not <STRONG>remove</STRONG> it from the index so much as mark it as deleted. It remains in the on-disc bucket structure and could be located in there using traditional filesystem tools - but it would not be searchable in Splunk any more.</P> Thu, 14 Apr 2011 06:51:15 GMT https://community.splunk.com/t5/Splunk-Search/Scrub-data-from-Splunk/m-p/81425#M181863 dwaddle 2011-04-14T06:51:15Z https://community.splunk.com/t5/Splunk-Search/Scrub-data-from-Splunk/m-p/81426#M181864 <P>To really clean, you would have to export the data you want to keep out of the index using command line <CODE>exporttool</CODE> or <CODE>splunk export</CODE> (possibly after doing <CODE>| delete</CODE>) then import back in with <CODE>importtool</CODE> or <CODE>splunk import</CODE>.</P> Thu, 14 Apr 2011 08:38:06 GMT https://community.splunk.com/t5/Splunk-Search/Scrub-data-from-Splunk/m-p/81426#M181864 gkanapathy 2011-04-14T08:38:06Z https://community.splunk.com/t5/Splunk-Search/Scrub-data-from-Splunk/m-p/81427#M181865 <P>Also see <A href="http://splunk-base.splunk.com/answers/2476/how-do-i-reclaim-disk-space-after-a-massive-delete-operation">http://splunk-base.splunk.com/answers/2476/how-do-i-reclaim-disk-space-after-a-massive-delete-operation</A></P> Mon, 19 Dec 2011 23:35:13 GMT https://community.splunk.com/t5/Splunk-Search/Scrub-data-from-Splunk/m-p/81427#M181865 stefanlasiewski 2011-12-19T23:35:13Z