Getting Data In

How do I delete old data for old data inputs, and why is our receiver not receiving any data from our universal forwarder?

mr_dombat
Explorer

I created some remote data inputs which worked well.

The documentation recommended using a universal forwarder for better performance.

I deleted the old data inputs ok, but the data remains.

How do I delete the old data?

(we are doing the free trial, so just trying to work out the best way to do things. The old data is not important).

1 Solution

Sebastian2
Path Finder

If you want the clear all data from an index you can use the CLI:

bin/splunk stop
bin/splunk clean eventdata -index <yourindex>
bin/splunk start

View solution in original post

Sebastian2
Path Finder

If you want the clear all data from an index you can use the CLI:

bin/splunk stop
bin/splunk clean eventdata -index <yourindex>
bin/splunk start

teunlaan
Contributor

Give user the can_delete permissions
Search for the old data (by source or somthing like that). If you found the data (and only the data you want to remove) do the same search, and place " | delete " after it.

Is will "hide" data and NOT remove it from disk

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...