how to delete

Path Finder


Am using csv file to indexing in splunk ..

I did the search for two days 16/01/2013 to till date and got the results as events.

Now just want to delete the events or records or rows that belongs to 16/01/2013 only.

How to do that?

Tags (1)
0 Karma


Have a look at;

You basically need to add the can_delete role to your user and then you can use | delete to mark the events as "deleted". They will persist in the buckets but Splunk won't display them when a user searches. So in your case you can run a search for your date, verify that you have only the data you want to delete on screen and then add the pipe to | delete


use the option "|" option to eliminate the value in the Search query

0 Karma