- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Splunk clean eventdata to an extent
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I am aware that you can permanently erase data from an index by typing the following command via CLI: splunk clean eventdata the_index
This would erase ALL data from the_index.
If I wanted to erase all events from the_index that were indexed on a particular date (e.g. 1st October 2012), how would I do this?
Thanks in advance for your help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer is you can't selectively delete data like that. You can use the delete command, which will "delete" data from a Splunk user perspective, but what it will really do is just mark the data as "deleted" rather than actually erasing it, so you won't free up any disk that way.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer is you can't selectively delete data like that. You can use the delete command, which will "delete" data from a Splunk user perspective, but what it will really do is just mark the data as "deleted" rather than actually erasing it, so you won't free up any disk that way.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK, thanks for your feedback.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, there is not, apart from the retention settings which will erase data based on its age.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok I will check it out. Thanks. One last thing, is there any way of selectively erasing data?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Deleted data cannot be undeleted. You can delete data using the delete command, the docs has info on it here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hmmm, that's not great. If I "delete" the data, can this action be reversed? Also, how do I "delete" data? Doing a full clean of an index is not an option. Splunk Devs...if you are watching, the above would be a useful addition 😉
Introducing the 2024 SplunkTrust!
Introducing the 2024 Splunk MVPs!
Splunk Custom Visualizations App End of Life
