Getting Data In
Highlighted

How do I delete a specific data input & its relating indexed events?

New Member

I have multiple data inputs going into one index. Is there a way to delete only one of those data inputs and scrub its relating events from the Events Indexed total?

I am aware of the clean command line approach, but it appears to limit me to eliminating the whole Event Index total or eliminating indexes only.

Thanks for any assistance!

0 Karma
Highlighted

Re: How do I delete a specific data input & its relating indexed events?

Builder

I believe you can use the | delete command. This is assuming you have the can delete role.
For example, when i want to delete all events from one source within an index i do

source= | delete

you should be able to also do

index= sourcetype= | delete

View solution in original post

Highlighted

Re: How do I delete a specific data input & its relating indexed events?

New Member

Genius! This worked for me Joetron!

One thing to note for others viewing this is that I had my data input pointing to a server location and so it ended up looking like this in the Search line, while I used the | delete command:

source="\\\\servername\\dir*" | delete

Interesting how I had to add an extra backslash for each backslash used. But it worked!

0 Karma
Highlighted

Re: How do I delete a specific data input & its relating indexed events?

Explorer

One thing to mention here is that the delete oeration does NOT free the disk space occupied by that particular events, It only makes the invisible to splunk queries.

0 Karma