delete input files

[pjmenon]

I am trying to remove unwanted input source files. Tried clean command

Stop splunk splunk clean filename

Does not work. Am I doing something wrong here?

[bwili]

This works for me:

source= | delete

Your user would of course need 'can delete' privs.

[Genti]

is this data in a certain index? is there any other data in this index that you do not want to delete?
Then there really is no easyer way to do this. Using the | delete command would be the best choice, and once data rolls to frozen it will then completely get deleted.

Otherwise if you do not care for the data on a certain index you can use the ./splunk delete eventdata
(note, all data in that index will be removed).

To remove the file from being indexed again go to your manager page and head to:
Manager » Data inputs » Files & Directories
then disable the file that you do not want to index anymore.

Hope this helps,
.gz

[pjmenon]

Both. Not sure if it matters, but it is a stand-alone file.

[Simeon]

You can selectively delete events via keyword searches by using the delete command:

http://www.splunk.com/base/Documentation/latest/SearchReference/Delete

[pjmenon]

I want to delete the entire data and wipe it out completely. My understanding is that Delete command will hide data but it does not remove the data permanently.

[Simeon]

Please clarify the question... Are you trying to delete data from the index, or are you trying to delete the input itself?