Archive
Highlighted

how to delete

Path Finder

Hi,

Am using csv file to indexing in splunk ..

I did the search for two days 16/01/2013 to till date and got the results as events.

Now just want to delete the events or records or rows that belongs to 16/01/2013 only.

How to do that?

Tags (1)
0 Karma
Highlighted

Re: how to delete

Contributor

use the option "|" option to eliminate the value in the Search query

0 Karma
Highlighted

Re: how to delete

Champion

Have a look at;

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk#Delete_events_from_f...

You basically need to add the can_delete role to your user and then you can use | delete to mark the events as "deleted". They will persist in the buckets but Splunk won't display them when a user searches. So in your case you can run a search for your date, verify that you have only the data you want to delete on screen and then add the pipe to | delete