Permanently delete events from an index

[marziaolla]

hi,
i want to delete from an index only the events i dont need.

i know that the delete command only hide events from the search but it doesnt delete them permanently, i want to save index space to not exceed my license.

how can i do this? can i do this from CLI?

[marziaolla]

[edit] i want to reduce the volume of indexed data.

[harsmarvania57]

Hi,

Index space does not have any relation with Splunk license. Splunk license calculates based on daily data ingestion. So if you do not want to free up space on disk then you can use delete command otherwise there will be option to clean whole index which will remove all data from your index.

[ChrisG]

harsmarvania57 has a very good point, which is that data stored in the index does not affect your license capacity. Quoting from the Admin Manual: "Splunk Enterprise licenses specify how much data you can index per calendar day (from midnight to midnight by the clock on the license master)."

Here are two documentation topics that might help you:

• Remove indexes and indexed data
• About license violations