Getting Data In

How to delete event data from an indexer using the REST API?

juandiaz
New Member

Hi everyone,

I have found similar questions and responses to this type of scenario, but I can’t seem to find a way to create an API version of the Shell commands to remove eventdata under a specific index. The Shell version of the commands would be:

Command 1: splunk stop
Command 2: splunk clean eventdata –<index>
Command 3: splunk start

The end goal is to use API calls to remove a retired index from the main indexer, and then delete the subsequent log event data on the server that falls under that index. I already have the API command to delete the index, I am just having trouble configuring the API call to remove that subsequent data.

Any help would be greatly appreciated. Thank you!

Tags (2)
0 Karma

bmacias84
Champion

The api does not provide facilities to clean the eventdata as Splunk daemon needs to be stopped. You are better off using remote ssh command or powershell command to run the shell commands. You can use the "|delete" command to mark the data as unsearchable via the api by create a search job, but that does not remove the data.

Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...