I have multiple data inputs going into one index. Is there a way to delete only one of those data inputs and scrub its relating events from the Events Indexed total?
I am aware of the clean command line approach, but it appears to limit me to eliminating the whole Event Index total or eliminating indexes only.
Thanks for any assistance!
I believe you can use the | delete command. This is assuming you have the can delete role.
For example, when i want to delete all events from one source within an index i do
you should be able to also do
Genius! This worked for me Joetron!
One thing to note for others viewing this is that I had my data input pointing to a server location and so it ended up looking like this in the Search line, while I used the | delete command:
source="\\\\servername\\dir*" | delete
Interesting how I had to add an extra backslash for each backslash used. But it worked!
One thing to mention here is that the delete oeration does NOT free the disk space occupied by that particular events, It only makes the invisible to splunk queries.