Getting Data In
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Source Types
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nikhilmehra79
Path Finder
12-29-2013
10:09 PM
I see 7 source types much of them are coming from my universal fwder in which i configured 7 logs files to send seperate source data, i removed 4 of them. Now the source is not updating the event data but at sources entry on Splunk UI still shows me 7 entries...how can i get rid of both the logged/indexed data in splunk database and the 3 log files (on UI) which is not getting updated for some time now.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
aholzer
Motivator
12-30-2013
07:00 AM
To get rid of already indexed data use the "delete" command. Go here for more info on delete: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete
Using this command is irreversable so be very careful. You'll have to assign the "can_delete" role to yourself before you are allowed to perform the delete command.
Hope this helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
aholzer
Motivator
12-30-2013
07:00 AM
To get rid of already indexed data use the "delete" command. Go here for more info on delete: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete
Using this command is irreversable so be very careful. You'll have to assign the "can_delete" role to yourself before you are allowed to perform the delete command.
Hope this helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
linu1988
Champion
12-31-2013
01:02 PM
But you can't delete the metadata .It will keep showing you 7 source/sourcetype after the delete command also. it only hides the data , doesn't even free up the disk space.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nikhilmehra79
Path Finder
12-31-2013
12:56 PM
ok make sense it answered my question
Get Updates on the Splunk Community!
Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data
In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...
Your summer travels continue with new course releases
Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...
From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...
It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...
