Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Source Types
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I see 7 source types much of them are coming from my universal fwder in which i configured 7 logs files to send seperate source data, i removed 4 of them. Now the source is not updating the event data but at sources entry on Splunk UI still shows me 7 entries...how can i get rid of both the logged/indexed data in splunk database and the 3 log files (on UI) which is not getting updated for some time now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To get rid of already indexed data use the "delete" command. Go here for more info on delete: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete
Using this command is irreversable so be very careful. You'll have to assign the "can_delete" role to yourself before you are allowed to perform the delete command.
Hope this helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To get rid of already indexed data use the "delete" command. Go here for more info on delete: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete
Using this command is irreversable so be very careful. You'll have to assign the "can_delete" role to yourself before you are allowed to perform the delete command.
Hope this helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
But you can't delete the metadata .It will keep showing you 7 source/sourcetype after the delete command also. it only hides the data , doesn't even free up the disk space.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ok make sense it answered my question
[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...
