Clients wanted a change in how there data was displayed using the sourcetype they first used. How do I remove all of what they have currently indexed so we don't get duplicate entries?
HI @nls7010,
in an Indexer Cluster, you could:
Ciao.
Giuseppe
check the below link
https://answers.splunk.com/answers/134553/how-to-delete-data-index-reset-start-from-scratch.html
Hope this helps.
Thanks
Anantha.