Getting Data In

How do I delete old data for old data inputs, and why is our receiver not receiving any data from our universal forwarder?

mr_dombat
Explorer

I created some remote data inputs which worked well.

The documentation recommended using a universal forwarder for better performance.

I deleted the old data inputs ok, but the data remains.

How do I delete the old data?

(we are doing the free trial, so just trying to work out the best way to do things. The old data is not important).

1 Solution

Sebastian2
Path Finder

If you want the clear all data from an index you can use the CLI:

bin/splunk stop
bin/splunk clean eventdata -index <yourindex>
bin/splunk start

View solution in original post

Sebastian2
Path Finder

If you want the clear all data from an index you can use the CLI:

bin/splunk stop
bin/splunk clean eventdata -index <yourindex>
bin/splunk start

teunlaan
Contributor

Give user the can_delete permissions
Search for the old data (by source or somthing like that). If you found the data (and only the data you want to remove) do the same search, and place " | delete " after it.

Is will "hide" data and NOT remove it from disk

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...