I added a test file as source and couldn't figure out a way to remove it anymore. I even deleted the file and restarted Splunk. No luck.
Any suggestion?
Thanks!
You can either clean out the whole index, i.e. delete everything that you've already added to the index in question. To do this,
stop splunk
splunk clean eventdata -index your_index
restart splunk
OR
you can pipe specific search results to 'delete', i.e. you will never see them again, but the operation won't free up any used disk space. This requires that you have admin privileges and add can_delete
to your role.
See the documentation for further guidance.
hope this helps,
Kristian
You can either clean out the whole index, i.e. delete everything that you've already added to the index in question. To do this,
stop splunk
splunk clean eventdata -index your_index
restart splunk
OR
you can pipe specific search results to 'delete', i.e. you will never see them again, but the operation won't free up any used disk space. This requires that you have admin privileges and add can_delete
to your role.
See the documentation for further guidance.
hope this helps,
Kristian
I tried the second approach and it works.
Thanks!