Getting Data In

How to remove data from an index when the file read is renamed?



I would like to remove data from an index when the file read is renamed.

I have a file ( which contains the program log which is currently running. When the program finishes to run without error, the file is renamed (prog.log.ok). As the file content is already indexed, the data are still present as source: So when the program finishes I would like to have the data removed from the index. Like that I can monitor only what is currently running.

Could you please help me to find a solution to that problem?


0 Karma


I am not sure why you want to remove the data from your index. Why not just filter out through your searches? If you still want to "remove" the old data you can either use the "delete" operator by entering something like this... index=blah source="" | delete. This will basically just hide the data from searching and viewing. If your index only contains this source and nothing else you would not need to specify the source in the search command. If you want to completely remove/clean all data from the index you can do this at the CLI with the clean command

  • splunk stop
  • splunk clean eventdata -index < *index_name >*

Be careful as this will remove all event data from the (index_name) and is NOT recoverable. If you neglect to provide the -index name ALL indexes are cleaned!

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...