https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93350#M24034 <P>Thank you for the suggestion! I would post it as a seperate question. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 09 Jul 2012 05:25:59 GMT jaterlwj 2012-07-09T05:25:59Z https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93346#M24030 <P>I know this may sound retarded, but I'm really new to Splunk so any help would be appreciated! I have been wondering. In the search app , how can I add/remove data from the "sources"? </P> <P>I have removed all data inputs using the manager but the data is still there. I have tried adding new data inputs as well but to no avail. </P> <P>The data source only references the first data that I fed it when I installed Splunk. Can any one be kind enough to help me?</P> Mon, 09 Jul 2012 01:52:36 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93346#M24030 jaterlwj 2012-07-09T01:52:36Z https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93347#M24031 <P>Mostly, you can't. Once the data is in, it's an administrative operation to remove it, and only with heavy restrictions.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/RemovedatafromSplunk">http://docs.splunk.com/Documentation/Splunk/latest/Admin/RemovedatafromSplunk</A></P> Mon, 09 Jul 2012 02:50:35 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93347#M24031 gkanapathy 2012-07-09T02:50:35Z https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93348#M24032 <P>Ahh. I managed to clear the indexes using the CLI clean command! Thank you. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>On a side note, I have tested and realized that when monitoring a file with let's say 24 rows with the option "Continuously index data from a file or directory this Splunk instance can access".</P> <P>I noticed that when I add a new row and refreshes. There are now 49 rows. The older 24 records are being duplicated. Is there any option to stop duplicate rows?</P> Mon, 09 Jul 2012 03:07:16 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93348#M24032 jaterlwj 2012-07-09T03:07:16Z https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93349#M24033 <P>That should be asked as a separate question with more details - generally if you just add a record to a source Splunk will not reindex everything (if it did, your license usage would grow exponentially), so there's something in your specific situation that makes it behave this way.</P> Mon, 09 Jul 2012 05:18:57 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93349#M24033 Ayn 2012-07-09T05:18:57Z https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93350#M24034 <P>Thank you for the suggestion! I would post it as a seperate question. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 09 Jul 2012 05:25:59 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93350#M24034 jaterlwj 2012-07-09T05:25:59Z https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93351#M24035 <P>I am facing the same problem! I can't find my newly added data input. It can't be accessed through Search! Why? Could anyone help me with this?</P> <P>P.S. I am new to Splunk.</P> Tue, 26 Feb 2013 10:52:37 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-sources-in-search/m-p/93351#M24035 anujamk 2013-02-26T10:52:37Z