Getting Data In

How to delete event data from an indexer using the REST API?

juandiaz
New Member

Hi everyone,

I have found similar questions and responses to this type of scenario, but I can’t seem to find a way to create an API version of the Shell commands to remove eventdata under a specific index. The Shell version of the commands would be:

Command 1: splunk stop
Command 2: splunk clean eventdata –<index>
Command 3: splunk start

The end goal is to use API calls to remove a retired index from the main indexer, and then delete the subsequent log event data on the server that falls under that index. I already have the API command to delete the index, I am just having trouble configuring the API call to remove that subsequent data.

Any help would be greatly appreciated. Thank you!

Tags (2)
0 Karma

bmacias84
Champion

The api does not provide facilities to clean the eventdata as Splunk daemon needs to be stopped. You are better off using remote ssh command or powershell command to run the shell commands. You can use the "|delete" command to mark the data as unsearchable via the api by create a search job, but that does not remove the data.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...