How to remove data from an index when the file read is renamed?

[SirHill17]

Hi,

I would like to remove data from an index when the file read is renamed.

I have a file (prog.log.run) which contains the program log which is currently running. When the program finishes to run without error, the file is renamed (prog.log.ok). As the file content is already indexed, the data are still present as source: prog.log.run. So when the program finishes I would like to have the data removed from the index. Like that I can monitor only what is currently running.

Could you please help me to find a solution to that problem?

Thanks!

[ndavis4]

I am not sure why you want to remove the data from your index. Why not just filter out through your searches? If you still want to "remove" the old data you can either use the "delete" operator by entering something like this... index=blah source="prog.log.run" | delete. This will basically just hide the data from searching and viewing. If your index only contains this source and nothing else you would not need to specify the source in the search command. If you want to completely remove/clean all data from the index you can do this at the CLI with the clean command

• splunk stop
• splunk clean eventdata -index < *index_name >*

Be careful as this will remove all event data from the (index_name) and is NOT recoverable. If you neglect to provide the -index name ALL indexes are cleaned!