Getting Data In

Delete indexed event and prevent from indexed again?

nhgiang1994
New Member

Hi,

I developing a Table dashboard with new data populated every 10 seconds using DBX. For some private reasons, I cannot use Rising Column of DBX, so there many duplicated events.

I also use Javascript to let the user to remove one or some row in the table. My current dummy strategy is:
1. Export the to-be-removed event to csv file using outputcsv command
2. Running a delete command
3. On the next refresh, compare with the csv file and eliminate the events with the same with removed event.

I must pause the dashboard refreshing to let the outputcsv complete or the removed event may re-appear because of the duplication. The problem is that outputcsv and the comparing process take very long to complete - which affect user experiences.

I want to ask if there is any neat way to mark the events as deleted and prevent it to be indexed again? Can I edit the indexed events and mark them as I wish?

Thanks

0 Karma
1 Solution

mayurr98
Super Champion

I think the best way to delete the events and prevent it t be indexed again is to send it to nullqueue.

Refer this document for more information
http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Discard_specific_ev...

This will make changes in real time and future events this will not change the data which is already indexed i.e. historical events that you need to delete using | delete command.

Let me know if this helps!

View solution in original post

0 Karma

mayurr98
Super Champion

I think the best way to delete the events and prevent it t be indexed again is to send it to nullqueue.

Refer this document for more information
http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Discard_specific_ev...

This will make changes in real time and future events this will not change the data which is already indexed i.e. historical events that you need to delete using | delete command.

Let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...