Getting Data In

Permanently delete events from an index

marziaolla
Explorer

hi,
i want to delete from an index only the events i dont need.

i know that the delete command only hide events from the search but it doesnt delete them permanently, i want to save index space to not exceed my license.

how can i do this? can i do this from CLI?

marziaolla
Explorer

[edit] i want to reduce the volume of indexed data.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Index space does not have any relation with Splunk license. Splunk license calculates based on daily data ingestion. So if you do not want to free up space on disk then you can use delete command otherwise there will be option to clean whole index which will remove all data from your index.

ChrisG
Splunk Employee
Splunk Employee

harsmarvania57 has a very good point, which is that data stored in the index does not affect your license capacity. Quoting from the Admin Manual: "Splunk Enterprise licenses specify how much data you can index per calendar day (from midnight to midnight by the clock on the license master)."

Here are two documentation topics that might help you:

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!