Getting Data In

How to remove data from an index when the file read is renamed?



I would like to remove data from an index when the file read is renamed.

I have a file ( which contains the program log which is currently running. When the program finishes to run without error, the file is renamed (prog.log.ok). As the file content is already indexed, the data are still present as source: So when the program finishes I would like to have the data removed from the index. Like that I can monitor only what is currently running.

Could you please help me to find a solution to that problem?


0 Karma


I am not sure why you want to remove the data from your index. Why not just filter out through your searches? If you still want to "remove" the old data you can either use the "delete" operator by entering something like this... index=blah source="" | delete. This will basically just hide the data from searching and viewing. If your index only contains this source and nothing else you would not need to specify the source in the search command. If you want to completely remove/clean all data from the index you can do this at the CLI with the clean command

  • splunk stop
  • splunk clean eventdata -index < *index_name >*

Be careful as this will remove all event data from the (index_name) and is NOT recoverable. If you neglect to provide the -index name ALL indexes are cleaned!

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...