Getting Data In

Delete indexed event and prevent from indexed again?

nhgiang1994
New Member

Hi,

I developing a Table dashboard with new data populated every 10 seconds using DBX. For some private reasons, I cannot use Rising Column of DBX, so there many duplicated events.

I also use Javascript to let the user to remove one or some row in the table. My current dummy strategy is:
1. Export the to-be-removed event to csv file using outputcsv command
2. Running a delete command
3. On the next refresh, compare with the csv file and eliminate the events with the same with removed event.

I must pause the dashboard refreshing to let the outputcsv complete or the removed event may re-appear because of the duplication. The problem is that outputcsv and the comparing process take very long to complete - which affect user experiences.

I want to ask if there is any neat way to mark the events as deleted and prevent it to be indexed again? Can I edit the indexed events and mark them as I wish?

Thanks

0 Karma
1 Solution

mayurr98
Super Champion

I think the best way to delete the events and prevent it t be indexed again is to send it to nullqueue.

Refer this document for more information
http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Discard_specific_ev...

This will make changes in real time and future events this will not change the data which is already indexed i.e. historical events that you need to delete using | delete command.

Let me know if this helps!

View solution in original post

0 Karma

mayurr98
Super Champion

I think the best way to delete the events and prevent it t be indexed again is to send it to nullqueue.

Refer this document for more information
http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Discard_specific_ev...

This will make changes in real time and future events this will not change the data which is already indexed i.e. historical events that you need to delete using | delete command.

Let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...