Getting Data In
Highlighted

How to remove recently indexed data

SplunkTrust
SplunkTrust

Hello,

I accidently had a file indexed by placing it in a directory from which splunk inputs in the logs.Is it possible to erase the newly indexed info because it messed up all my searches ?

Can I delete some sort of file or something in order to erase recently indexed data ?

Same goes for the information that was taken into the data model, what can I do to remove or undo what i added.

Thanks,
David

0 Karma
Highlighted

Re: How to remove recently indexed data

Super Champion

You can create a search that pull the data you want to get rid of, and ONLY the data you want to get rid of, and then add delete to the end of the search. This will not actually remove the data from the index, i.e. make the index smaller, but it will make the data unsearchable.

I recommend reading this article first:

http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete

View solution in original post

Highlighted

Re: How to remove recently indexed data

SplunkTrust
SplunkTrust

Cool, thank you.. now i just need to find out how to get the permission to do so cause i can't seem to use |delete even as admin

0 Karma
Highlighted

Re: How to remove recently indexed data

Super Champion

Delete is a special feature. Go to Manager > Access Controls > Users > your user > and give yourself "Can Delete" permission under Assign to Roles.

0 Karma
Highlighted

Re: How to remove recently indexed data

SplunkTrust
SplunkTrust

Found it ! thanks a lot!

wish i had points to award you 🙂

0 Karma
Highlighted

Re: How to remove recently indexed data

Super Champion

Use the check mark to accept the answer, and it will give you 10 more points I think.

0 Karma
Highlighted

Re: How to remove recently indexed data

SplunkTrust
SplunkTrust

Cool 🙂 thank you.
And one more thing, does deleting also mask the data in a data model or does this only work for indexes ?

0 Karma
Highlighted

Re: How to remove recently indexed data

Engager

can u tell how to remove the data permanently not just hiding it by using delete option?
Any response will be a great help. Thanks in advance:)

Highlighted

Re: How to remove recently indexed data

Ultra Champion

Remove indexes and indexed data

speaks about it.

It says
-- To delete indexed data permanently from your disk, use the CLI clean command. This command completely deletes the data in one or all indexes, depending on whether you provide an argument.

0 Karma