topic Re: Unable to delete events? in Splunk Search

Unable to delete events?

remy06 — Wed, 14 Jul 2010 16:49:49 GMT

I've tried to delete events for a particular source,say source="tcp:1234" | delete

The operation was successful.However after I returned to the search summary page, there are events still listed with that source..

When I clicked on it, it takes me to search page but indicate '0 matching events'.

Is it a bug?

Re: Unable to delete events?

Paolo_Prigione — Wed, 14 Jul 2010 18:13:40 GMT

The "delete" command doesn't really delete the events from the index: it marks them so that they are not displayed anymore as search results. Unluckily right now, the index metadata are not updated, so those events are still presents in the summary page.

The only way to phisically erase events is to clean-up the index but that is not selective.

Re: Unable to delete events?

remy06 — Thu, 15 Jul 2010 10:00:44 GMT

Thanks. I've noticed it takes a while for the events to be displayed as '0'. Are we able to or is it safe enough to remove those '0' entries from Hosts.data,SourceType.data, Sources.data ?

Re: Unable to delete events?

gkanapathy — Thu, 15 Jul 2010 10:46:37 GMT

You should not under usual circumstances edit those files by hand. They will be updated by Splunk automatically.

Re: Unable to delete events?

gkanapathy — Thu, 15 Jul 2010 10:48:17 GMT

Other (much more complicated and often infeasible) options are to export selectively, and reimport, or to drop and re-index data from either an original source or a partial export. There are no general instructions because the ability to do this is specific to you situation.