Remove events to avoid delayed logging?

[wickman]

Our generated logs need to be verified for correctness. After verification, they are sent to splunk.

Problem is the verification happens some hours after the logs are generated. This means they are sent to splunk hours after they are created (ie logs appear delayed, not in real time).

In 99.9999% of all cases, logs are verified ok which means this delay not needed.

Is there a way around this? My naive idea is to have splunk pick up the unverified logs immediately, and then (hours later) when they are verified confirm them in splunk or delete/mark/evict invalid logs from the index.

Is this possible or can I use some other approach?

/Thanks!

[martin_mueller]

If those cases really are rare you can use the delete command to selectively mark events as deleted. That won't clear up space, and isn't recommended for frequent use.

[martin_mueller]

Sure, you can start any search job remotely via the REST API or one of the SDKs available at http://dev.splunk.com/

[wickman]

Is it possible to script the delete command remotely? I'm thinking the verifier could do that automatically when it detects an invalid log?