Getting Data In
Highlighted

delete input files

Explorer

I am trying to remove unwanted input source files. Tried clean command

Stop splunk splunk clean filename

Does not work. Am I doing something wrong here?

Tags (2)
0 Karma
Highlighted

Re: delete input files

Splunk Employee
Splunk Employee

Please clarify the question... Are you trying to delete data from the index, or are you trying to delete the input itself?

Highlighted

Re: delete input files

Splunk Employee
Splunk Employee

You can selectively delete events via keyword searches by using the delete command:

http://www.splunk.com/base/Documentation/latest/SearchReference/Delete

Highlighted

Re: delete input files

Explorer

I want to delete the entire data and wipe it out completely. My understanding is that Delete command will hide data but it does not remove the data permanently.

0 Karma
Highlighted

Re: delete input files

Explorer

Both. Not sure if it matters, but it is a stand-alone file.

0 Karma
Highlighted

Re: delete input files

Splunk Employee
Splunk Employee

is this data in a certain index? is there any other data in this index that you do not want to delete?
Then there really is no easyer way to do this. Using the | delete command would be the best choice, and once data rolls to frozen it will then completely get deleted.

Otherwise if you do not care for the data on a certain index you can use the ./splunk delete eventdata
(note, all data in that index will be removed).

To remove the file from being indexed again go to your manager page and head to:
Manager » Data inputs » Files & Directories
then disable the file that you do not want to index anymore.

Hope this helps,
.gz

Highlighted

Re: delete input files

Explorer

This works for me:

source= | delete

Your user would of course need 'can delete' privs.

0 Karma