I am aware that you can permanently erase data from an index by typing the following command via CLI:
splunk clean eventdata the_index
This would erase ALL data from
If I wanted to erase all events from
the_index that were indexed on a particular date (e.g. 1st October 2012), how would I do this?
Thanks in advance for your help.
The answer is you can't selectively delete data like that. You can use the
delete command, which will "delete" data from a Splunk user perspective, but what it will really do is just mark the data as "deleted" rather than actually erasing it, so you won't free up any disk that way.
Hmmm, that's not great. If I "delete" the data, can this action be reversed? Also, how do I "delete" data? Doing a full clean of an index is not an option. Splunk Devs...if you are watching, the above would be a useful addition 😉