Getting Data In

How do I delete events?

the_wolverine
Champion

I have some data in my index that I don't want. How can I get rid of them?

Tags (3)
1 Solution

the_wolverine
Champion

You can search for your unwanted events and then pipe them to delete. For example:

sourcetype=wantedsource | delete

It's a good idea to search for your events first and confirm that these events are the correct events.

Important notes:

  • The user running this command must have the delete capability or be assigned the can_delete role.

  • This command does not reclaim disk space. It merely masks the deleted events so that they are not returned as part of search results. To reclaim disk space, you need to clean the index -- if all of your unwanted data is in one index then you can simply clean that index. Or, set an automatic archival policy to, eventually, expire your data automatically but then you'll have wait for the trigger (size or age.)

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

FYI: You can only run the | delete command if you add the can_delete option in the role of the user.

tpaulsen
Contributor

Yes, that´s what was stated in the original answer already.

tpaulsen
Contributor

Will the deleted masked events age out as well?

0 Karma

the_wolverine
Champion

You can search for your unwanted events and then pipe them to delete. For example:

sourcetype=wantedsource | delete

It's a good idea to search for your events first and confirm that these events are the correct events.

Important notes:

  • The user running this command must have the delete capability or be assigned the can_delete role.

  • This command does not reclaim disk space. It merely masks the deleted events so that they are not returned as part of search results. To reclaim disk space, you need to clean the index -- if all of your unwanted data is in one index then you can simply clean that index. Or, set an automatic archival policy to, eventually, expire your data automatically but then you'll have wait for the trigger (size or age.)

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...