How to delete specific event?

[ford1863]

Hello,

How can I delete some specific event in Splunk? For example, one log loaded in splunk with 50 events, and I want to delete one or two events in them.

[Ayn · Accepted solution]

Use the delete operator.

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Delete

Note that you need the can_delete privileged in order to be able to use this, and by default no roles (not even admin) have this privilege, so you'll need to add it before you can use this command.