Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Splunk clean eventdata to an extent
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I am aware that you can permanently erase data from an index by typing the following command via CLI: splunk clean eventdata the_index
This would erase ALL data from the_index.
If I wanted to erase all events from the_index that were indexed on a particular date (e.g. 1st October 2012), how would I do this?
Thanks in advance for your help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer is you can't selectively delete data like that. You can use the delete command, which will "delete" data from a Splunk user perspective, but what it will really do is just mark the data as "deleted" rather than actually erasing it, so you won't free up any disk that way.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer is you can't selectively delete data like that. You can use the delete command, which will "delete" data from a Splunk user perspective, but what it will really do is just mark the data as "deleted" rather than actually erasing it, so you won't free up any disk that way.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK, thanks for your feedback.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, there is not, apart from the retention settings which will erase data based on its age.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok I will check it out. Thanks. One last thing, is there any way of selectively erasing data?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Deleted data cannot be undeleted. You can delete data using the delete command, the docs has info on it here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hmmm, that's not great. If I "delete" the data, can this action be reversed? Also, how do I "delete" data? Doing a full clean of an index is not an option. Splunk Devs...if you are watching, the above would be a useful addition 😉
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Automating Threat Operations and Threat Hunting with Recorded Future
Keep the Learning Going with the New Best of .conf Hub
Splunk Community Badges!
