Getting Data In

How do I delete events?

the_wolverine
Champion

I have some data in my index that I don't want. How can I get rid of them?

Tags (3)
1 Solution

the_wolverine
Champion

You can search for your unwanted events and then pipe them to delete. For example:

sourcetype=wantedsource | delete

It's a good idea to search for your events first and confirm that these events are the correct events.

Important notes:

  • The user running this command must have the delete capability or be assigned the can_delete role.

  • This command does not reclaim disk space. It merely masks the deleted events so that they are not returned as part of search results. To reclaim disk space, you need to clean the index -- if all of your unwanted data is in one index then you can simply clean that index. Or, set an automatic archival policy to, eventually, expire your data automatically but then you'll have wait for the trigger (size or age.)

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

FYI: You can only run the | delete command if you add the can_delete option in the role of the user.

tpaulsen
Contributor

Yes, that´s what was stated in the original answer already.

tpaulsen
Contributor

Will the deleted masked events age out as well?

0 Karma

the_wolverine
Champion

You can search for your unwanted events and then pipe them to delete. For example:

sourcetype=wantedsource | delete

It's a good idea to search for your events first and confirm that these events are the correct events.

Important notes:

  • The user running this command must have the delete capability or be assigned the can_delete role.

  • This command does not reclaim disk space. It merely masks the deleted events so that they are not returned as part of search results. To reclaim disk space, you need to clean the index -- if all of your unwanted data is in one index then you can simply clean that index. Or, set an automatic archival policy to, eventually, expire your data automatically but then you'll have wait for the trigger (size or age.)

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...