Getting Data In

How do I delete events?

the_wolverine
Champion

I have some data in my index that I don't want. How can I get rid of them?

Tags (3)
1 Solution

the_wolverine
Champion

You can search for your unwanted events and then pipe them to delete. For example:

sourcetype=wantedsource | delete

It's a good idea to search for your events first and confirm that these events are the correct events.

Important notes:

  • The user running this command must have the delete capability or be assigned the can_delete role.

  • This command does not reclaim disk space. It merely masks the deleted events so that they are not returned as part of search results. To reclaim disk space, you need to clean the index -- if all of your unwanted data is in one index then you can simply clean that index. Or, set an automatic archival policy to, eventually, expire your data automatically but then you'll have wait for the trigger (size or age.)

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

FYI: You can only run the | delete command if you add the can_delete option in the role of the user.

tpaulsen
Contributor

Yes, that´s what was stated in the original answer already.

tpaulsen
Contributor

Will the deleted masked events age out as well?

0 Karma

the_wolverine
Champion

You can search for your unwanted events and then pipe them to delete. For example:

sourcetype=wantedsource | delete

It's a good idea to search for your events first and confirm that these events are the correct events.

Important notes:

  • The user running this command must have the delete capability or be assigned the can_delete role.

  • This command does not reclaim disk space. It merely masks the deleted events so that they are not returned as part of search results. To reclaim disk space, you need to clean the index -- if all of your unwanted data is in one index then you can simply clean that index. Or, set an automatic archival policy to, eventually, expire your data automatically but then you'll have wait for the trigger (size or age.)

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...