Is there a way to reverse the action of "splunk add oneshot" on a specific input file?

[sissa]

Our Splunk forwarder has missed one file (1 hour worth of logs) for some reason, so I used oneshot to load the missing file:

/opt/splunkforwarder/bin/splunk add oneshot <log_file> 1 -sourcetype <spourcetype1> -index <index1> -host <host1> -auth user:pwd

Unfortunately, I ran the above command twice, and we ended up with double the records.

Is there a way to remove these specific records without compromising the entire index?

[esix_splunk · Accepted solution]

You can use the delete command from search.. ( you do need to add this ability to your role.)

index=whatever sourcetype=oneshott'dsourcetypename | delete

Of course, change the index name and sourcetype to match what you added it as. And note, this will delete all the data you one-shotted. So this assumes that the sourcetype is unique for the oneshot data. If you added this to an existing sourcetype, then you would need to adjust this search to the source you added it as.

Also, this deletes all events that were added. You can either modify the search to try and delete only a single set of the duplicates, or delete them all, and re-oneshot the data.

[sissa]

Thanks for the prompt response, much appreciated, unfortunately I couldn't do it myself, I need to wait for the administrator to either grant me access to delete or do it on my behalf.
cheers