Getting Data In

How to delete a sourcetype from one of my indexes?

newbiesplunk
Path Finder

Hi,

I have two sourcetypes forwarded to an index, but I just want to delete one of the sourcetypes from this index. What is the approach? thks

Tags (3)
0 Karma

gyslainlatsa
Motivator

hi newbiesplunk ,
if your index has one sourcetype , you can remove once the index using the next command splunk clean -index ‹indexname›

0 Karma

satishsdange
Builder

You won't able to delete partial data once data is indexed. Either you have to clean index data or follow above recommendation.

0 Karma

gyslainlatsa
Motivator

hi,
your index How sourcetype?
please forgive my english

0 Karma

newbiesplunk
Path Finder

hi, i saw there is a rebuild index function (splunk rebuild ), can i use for my case? thks

0 Karma

kml_uvce
Builder

use this search

index=indexname sourcetype=sourecetypename|delete

this will not delete the data from the sourcetype but you will not see any data from this sourcetype in search

kamal singh bisht

newbiesplunk
Path Finder

Hi, I know this search but i need to remove it permanently from the index, what will be the advise? thks

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

When you delete the data via the | delete command, this marks the buckets as unsearchable and this data will be aged out via the retention period of the index.

Aside from this, you need to modify your inputs to make sure that data source isnt sent to this index anymore.

Why isnt this sufficient for your use case? Data will not be visible to user or available to search, so for all intensive purposes, the data is deleted.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...