Also, as pointed out by MuS, the | delete
does not actually remove anything from the index, and if you clean
an index, you clean
everything in it.
Therefore, when playing around with new sources/sourcetypes you should always use a test index, where you can test your line-breaking, transforms etc etc, without polluting the 'real' index.
When you're satisfied and everything works fine, you can the set up your real monitor stanzas and direct it to your main index.
hth,
Kristian
Also, as pointed out by MuS, the | delete
does not actually remove anything from the index, and if you clean
an index, you clean
everything in it.
Therefore, when playing around with new sources/sourcetypes you should always use a test index, where you can test your line-breaking, transforms etc etc, without polluting the 'real' index.
When you're satisfied and everything works fine, you can the set up your real monitor stanzas and direct it to your main index.
hth,
Kristian
Hi shantanuo
you cannot delete an indexed file like this from an index, you have to do a search for the
source='WhatEverNameYourFileHad' | delete
this way you are removing the source from future searches events or you do a clean
on your index to delete indexed data.
please read the docs about this before you do this 😉
cheers