Knowledge Management

How do I remove a source?

yuanqi
New Member

I added a test file as source and couldn't figure out a way to remove it anymore. I even deleted the file and restarted Splunk. No luck.
Any suggestion?

Thanks!

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

You can either clean out the whole index, i.e. delete everything that you've already added to the index in question. To do this,

     stop splunk
     splunk clean eventdata -index your_index
     restart splunk

OR

you can pipe specific search results to 'delete', i.e. you will never see them again, but the operation won't free up any used disk space. This requires that you have admin privileges and add can_delete to your role.

See the documentation for further guidance.

hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

You can either clean out the whole index, i.e. delete everything that you've already added to the index in question. To do this,

     stop splunk
     splunk clean eventdata -index your_index
     restart splunk

OR

you can pipe specific search results to 'delete', i.e. you will never see them again, but the operation won't free up any used disk space. This requires that you have admin privileges and add can_delete to your role.

See the documentation for further guidance.

hope this helps,

Kristian

yuanqi
New Member

I tried the second approach and it works.
Thanks!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>