Getting Data In
Highlighted

Permanently delete events from an index

Explorer

hi,
i want to delete from an index only the events i dont need.

i know that the delete command only hide events from the search but it doesnt delete them permanently, i want to save index space to not exceed my license.

how can i do this? can i do this from CLI?

Highlighted

Re: Permanently delete events from an index

SplunkTrust
SplunkTrust

Hi,

Index space does not have any relation with Splunk license. Splunk license calculates based on daily data ingestion. So if you do not want to free up space on disk then you can use delete command otherwise there will be option to clean whole index which will remove all data from your index.

Highlighted

Re: Permanently delete events from an index

Splunk Employee
Splunk Employee

harsmarvania57 has a very good point, which is that data stored in the index does not affect your license capacity. Quoting from the Admin Manual: "Splunk Enterprise licenses specify how much data you can index per calendar day (from midnight to midnight by the clock on the license master)."

Here are two documentation topics that might help you:

Highlighted

Re: Permanently delete events from an index

Explorer

[edit] i want to reduce the volume of indexed data.

0 Karma