Splunk Dev

How to delete all data of index using python?

ejespiritu
Explorer

Hi All,

So I'm wondering if it's possible to use a python script that runs on a schedule to delete all the content of an index.

Thanks!

0 Karma
1 Solution

PowerPacked
Builder

Hi @ejespiritu

Take a look at the Delete command, here is the link.

https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Delete

You can make this as a scheduled search, make it run frequently to delete the data.

& another thing to remind of is, you need to have delete permissions enabled for you role to delete the data from index ( delete permissions are separate from admin permissions )

Thank you

View solution in original post

0 Karma

PowerPacked
Builder

Hi @ejespiritu

Take a look at the Delete command, here is the link.

https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Delete

You can make this as a scheduled search, make it run frequently to delete the data.

& another thing to remind of is, you need to have delete permissions enabled for you role to delete the data from index ( delete permissions are separate from admin permissions )

Thank you

0 Karma

soumyasaha25
Contributor

Do you want the data to be deleted permanently from the index (disk) or just want it to be unsearchable while still retaining the data on the indexes (disks).

0 Karma

ejespiritu
Explorer

delete permanently as i need it to be replaced as a whole every month

0 Karma

soumyasaha25
Contributor

yes, as @PowerPacker pointed out below, you can run a scheduled search and set "run script" in alert actions to delete the index.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...