How do I remove a source?

[yuanqi]

I added a test file as source and couldn't figure out a way to remove it anymore. I even deleted the file and restarted Splunk. No luck.
Any suggestion?

Thanks!

[kristian_kolb · Accepted solution]

You can either clean out the whole index, i.e. delete everything that you've already added to the index in question. To do this,

     stop splunk
     splunk clean eventdata -index your_index
     restart splunk

OR

you can pipe specific search results to 'delete', i.e. you will never see them again, but the operation won't free up any used disk space. This requires that you have admin privileges and add can_delete to your role.

See the documentation for further guidance.

hope this helps,

Kristian

[yuanqi]

I tried the second approach and it works.
Thanks!