Getting Data In

How do I delete a specific data input & its relating indexed events?

sthao
New Member

I have multiple data inputs going into one index. Is there a way to delete only one of those data inputs and scrub its relating events from the Events Indexed total?

I am aware of the clean command line approach, but it appears to limit me to eliminating the whole Event Index total or eliminating indexes only.

Thanks for any assistance!

0 Karma
1 Solution

RicoSuave
Builder

I believe you can use the | delete command. This is assuming you have the can delete role.
For example, when i want to delete all events from one source within an index i do

source= | delete

you should be able to also do

index= sourcetype= | delete

View solution in original post

RicoSuave
Builder

I believe you can use the | delete command. This is assuming you have the can delete role.
For example, when i want to delete all events from one source within an index i do

source= | delete

you should be able to also do

index= sourcetype= | delete

traugust
Explorer

One thing to mention here is that the delete oeration does NOT free the disk space occupied by that particular events, It only makes the invisible to splunk queries.

0 Karma

sthao
New Member

Genius! This worked for me Joetron!

One thing to note for others viewing this is that I had my data input pointing to a server location and so it ended up looking like this in the Search line, while I used the | delete command:

source="\\\\servername\\dir*" | delete

Interesting how I had to add an extra backslash for each backslash used. But it worked!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...