Getting Data In

How do I delete a specific data input & its relating indexed events?

sthao
New Member

I have multiple data inputs going into one index. Is there a way to delete only one of those data inputs and scrub its relating events from the Events Indexed total?

I am aware of the clean command line approach, but it appears to limit me to eliminating the whole Event Index total or eliminating indexes only.

Thanks for any assistance!

0 Karma
1 Solution

RicoSuave
Builder

I believe you can use the | delete command. This is assuming you have the can delete role.
For example, when i want to delete all events from one source within an index i do

source= | delete

you should be able to also do

index= sourcetype= | delete

View solution in original post

RicoSuave
Builder

I believe you can use the | delete command. This is assuming you have the can delete role.
For example, when i want to delete all events from one source within an index i do

source= | delete

you should be able to also do

index= sourcetype= | delete

traugust
Explorer

One thing to mention here is that the delete oeration does NOT free the disk space occupied by that particular events, It only makes the invisible to splunk queries.

0 Karma

sthao
New Member

Genius! This worked for me Joetron!

One thing to note for others viewing this is that I had my data input pointing to a server location and so it ended up looking like this in the Search line, while I used the | delete command:

source="\\\\servername\\dir*" | delete

Interesting how I had to add an extra backslash for each backslash used. But it worked!

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...