How to delete data in an index from a certain host?

[PIETRO_CENTANNI]

Hi

I have a need to save space on an indexer server.

In the main index, I have a data from a host that is not used and I would like to delete all of its data from the index.

How can I delete data only from this host without deleting everything in the main index? I want to delete the data, not hide it.

Thanks

[renjith_nair · Accepted solution]

Hello @PIETRO_CENTANNI ,

Unfortunately, "splunk clean" is unable to delete specific data from index. It's all-or-nothing : The entire index has to be wiped, or none of it.
Instead you can set the retention period in Splunk for the particular index and delete old events to free up some space (frozenTimePeriodInSecs).

See
http://docs.splunk.com/Documentation/Splunk/6.0.2/Indexer/Setaretirementandarchivingpolicy
https://wiki.splunk.com/Deploy:BucketRotationAndRetention

[PIETRO_CENTANNI]

I have already a policy retention the I can't modify.
So the unique solution is add space.

Thank you and have a nice day

[fdi01]

use clean command in splunk to do it.
from splunk_home/splunk/bin/ repertory in CLI,
run ./splunk help clean to understans how clean command work.
like this :

./splunk clean eventdata -index  your_index_name -f

[PIETRO_CENTANNI]

This command delete all index. I have need delete a single host from index.

[klsio]

Using this command.

index='foo' | delete

[woodcock]

This command does not actually delete anything; it just hides it. Therefore, there is no impact upon disk space.

[klsio]

ah.. thank you 🙂