Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Source Types
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I see 7 source types much of them are coming from my universal fwder in which i configured 7 logs files to send seperate source data, i removed 4 of them. Now the source is not updating the event data but at sources entry on Splunk UI still shows me 7 entries...how can i get rid of both the logged/indexed data in splunk database and the 3 log files (on UI) which is not getting updated for some time now.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To get rid of already indexed data use the "delete" command. Go here for more info on delete: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete
Using this command is irreversable so be very careful. You'll have to assign the "can_delete" role to yourself before you are allowed to perform the delete command.
Hope this helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To get rid of already indexed data use the "delete" command. Go here for more info on delete: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete
Using this command is irreversable so be very careful. You'll have to assign the "can_delete" role to yourself before you are allowed to perform the delete command.
Hope this helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
But you can't delete the metadata .It will keep showing you 7 source/sourcetype after the delete command also. it only hides the data , doesn't even free up the disk space.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ok make sense it answered my question
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
