topic how to delete in Splunk Search

how to delete

balajsoz — Thu, 17 Jan 2013 09:17:54 GMT

Hi,

Am using csv file to indexing in splunk ..

I did the search for two days 16/01/2013 to till date and got the results as events.

Now just want to delete the events or records or rows that belongs to 16/01/2013 only.

How to do that?

Re: how to delete

chimbudp — Thu, 17 Jan 2013 10:16:09 GMT

use the option "|" option to eliminate the value in the Search query

Re: how to delete

Drainy — Thu, 17 Jan 2013 10:21:52 GMT

Have a look at;

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk#Delete_events_from_future_searches

You basically need to add the can_delete role to your user and then you can use | delete to mark the events as "deleted". They will persist in the buckets but Splunk won't display them when a user searches. So in your case you can run a search for your date, verify that you have only the data you want to delete on screen and then add the pipe to | delete