How to remove sources from disk via CLI?

Benlavender · ‎11-19-2014

Hello,

We’re looking to remove data from one of our indexes, preferably using the clean operator from the CLI.

We have the some sources like “Perfmon:CPU Load” and “WinEventLog:System” – What would the correct clean syntax be to remove these sources from disk in the CLI be please?

Thanks

yannK · ‎11-19-2014

There is no way to remove selectively data from a bucket/index.
you can only hide it using the "|delete" command
or delete all data with the "clean" command

How to remove sources from disk via CLI?

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Are you a member of the Splunk Community?

How to remove sources from disk via CLI?

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever