Getting Data In

delete input files

pjmenon
Explorer

I am trying to remove unwanted input source files. Tried clean command

Stop splunk splunk clean filename

Does not work. Am I doing something wrong here?

Tags (2)
0 Karma

bwili
Explorer

This works for me:

source= | delete

Your user would of course need 'can delete' privs.

0 Karma

Genti
Splunk Employee
Splunk Employee

is this data in a certain index? is there any other data in this index that you do not want to delete?
Then there really is no easyer way to do this. Using the | delete command would be the best choice, and once data rolls to frozen it will then completely get deleted.

Otherwise if you do not care for the data on a certain index you can use the ./splunk delete eventdata
(note, all data in that index will be removed).

To remove the file from being indexed again go to your manager page and head to:
Manager » Data inputs » Files & Directories
then disable the file that you do not want to index anymore.

Hope this helps,
.gz

pjmenon
Explorer

Both. Not sure if it matters, but it is a stand-alone file.

0 Karma

Simeon
Splunk Employee
Splunk Employee

You can selectively delete events via keyword searches by using the delete command:

http://www.splunk.com/base/Documentation/latest/SearchReference/Delete

pjmenon
Explorer

I want to delete the entire data and wipe it out completely. My understanding is that Delete command will hide data but it does not remove the data permanently.

0 Karma

Simeon
Splunk Employee
Splunk Employee

Please clarify the question... Are you trying to delete data from the index, or are you trying to delete the input itself?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...