How do we delete old data for only three files in the one index ?

[kiranpanchavat1]

we need to delete three files from the index 

I have used the |delete command to clean the indexed data and it’s deleted but still its showing under the source field.

source='/var/log/splunk/syslog/******/********' | delete

source='/var/log/splunk/syslog/******/********' | delete

source='/var/log/splunk/syslog/******/********' | delete

[gcusello]

Hi @kiranpanchavat1,

the delete command makes only a logical deleting of the events but it doesn't remove the deleted events from the buckets.

If you want to fully clean an index you can use the command 

./splunk clean eventdata -index <your_index>

if you want to remove all the entire buckets where the latest event exceeds a retention time, you could change the retention time for that index, wait for the deletion of old data and the set up again the the correct retention time disk.

It isn't possible to physically delete only a part of events in a bucket.

Ciao.

Giuseppe

[kiranpanchavat1]

@gcusello 

See, my data is stored in one index and in that index there are so many data is storing so i need to delete only the particular files 

[gcusello]

Hi @kiranpanchavat1,

if you're speaking of delete an entire bucket, in Community there are some examples of deleting buckets but I didn't directly tested:

https://community.splunk.com/t5/Deployment-Architecture/How-to-manually-delete-buckets-in-cluster-pe...

https://community.splunk.com/t5/Deployment-Architecture/Delete-corrupt-bucket-or-down-index-in-clust...

If instead you want to delete only a part of a bucket it isn't possible, you can only make a logical deletion (delete command).

Ciao.

Giuseppe

[kiranpanchavat1]

@gcusello Can you provide me the btprobe command details 

[gcusello]

Hi @kiranpanchavat1,

https://docs.splunk.com/Documentation/Splunk/8.2.3/Troubleshooting/CommandlinetoolsforusewithSupport...

I never used it.

Ciao.

Giuseppe

[PickleRick]

What do you mean by "still showing under the source field"?

Also, you know that delete doesn't physically remove the data from index files? Just marks them as inaccessible.