Splunk clean eventdata to an extent

[Ant1D]

Hi,

I am aware that you can permanently erase data from an index by typing the following command via CLI: splunk clean eventdata the_index

This would erase ALL data from the_index.

If I wanted to erase all events from the_index that were indexed on a particular date (e.g. 1st October 2012), how would I do this?

Thanks in advance for your help.

[Ayn · Accepted solution]

The answer is you can't selectively delete data like that. You can use the delete command, which will "delete" data from a Splunk user perspective, but what it will really do is just mark the data as "deleted" rather than actually erasing it, so you won't free up any disk that way.

[Ant1D]

OK, thanks for your feedback.

[Ayn]

No, there is not, apart from the retention settings which will erase data based on its age.

[Ant1D]

Ok I will check it out. Thanks. One last thing, is there any way of selectively erasing data?

[Ayn]

Deleted data cannot be undeleted. You can delete data using the delete command, the docs has info on it here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete

[Ant1D]

Hmmm, that's not great. If I "delete" the data, can this action be reversed? Also, how do I "delete" data? Doing a full clean of an index is not an option. Splunk Devs...if you are watching, the above would be a useful addition 😉