Getting Data In

How to delete data in an index from a certain host?

PIETRO_CENTANNI
New Member

Hi

I have a need to save space on an indexer server.

In the main index, I have a data from a host that is not used and I would like to delete all of its data from the index.

How can I delete data only from this host without deleting everything in the main index? I want to delete the data, not hide it.

Thanks

0 Karma
1 Solution

renjith_nair
Legend

Hello @PIETRO_CENTANNI ,

Unfortunately, "splunk clean" is unable to delete specific data from index. It's all-or-nothing : The entire index has to be wiped, or none of it.
Instead you can set the retention period in Splunk for the particular index and delete old events to free up some space (frozenTimePeriodInSecs).

See
http://docs.splunk.com/Documentation/Splunk/6.0.2/Indexer/Setaretirementandarchivingpolicy
https://wiki.splunk.com/Deploy:BucketRotationAndRetention

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

Hello @PIETRO_CENTANNI ,

Unfortunately, "splunk clean" is unable to delete specific data from index. It's all-or-nothing : The entire index has to be wiped, or none of it.
Instead you can set the retention period in Splunk for the particular index and delete old events to free up some space (frozenTimePeriodInSecs).

See
http://docs.splunk.com/Documentation/Splunk/6.0.2/Indexer/Setaretirementandarchivingpolicy
https://wiki.splunk.com/Deploy:BucketRotationAndRetention

---
What goes around comes around. If it helps, hit it with Karma 🙂

PIETRO_CENTANNI
New Member

I have already a policy retention the I can't modify.
So the unique solution is add space.

Thank you and have a nice day

0 Karma

fdi01
Motivator

use clean command in splunk to do it.
from splunk_home/splunk/bin/ repertory in CLI,
run ./splunk help clean to understans how clean command work.
like this :

./splunk clean eventdata -index  your_index_name -f
0 Karma

PIETRO_CENTANNI
New Member

This command delete all index. I have need delete a single host from index.

0 Karma

klsio
Explorer

Using this command.

index='foo' | delete

0 Karma

woodcock
Esteemed Legend

This command does not actually delete anything; it just hides it. Therefore, there is no impact upon disk space.

0 Karma

klsio
Explorer

ah.. thank you 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...