How to delete a log by splunk api

[carineconstanti]

Hi, everubody

I monitor some files and sometime the data in these files are updated

I need to delete wrong data on Splunk by API.

How I can delete only a log that is wrong and that has been indexed on Splunk by Api command ?

Thanks

[micahkemp]

If you can suffuciently craft a search that finds only the event(s) you want to delete, you can pipe the results of that search to the delete command.

Note that none of the default roles have the can_delete capability. You would need to either add this capability to a role temporarily, or create a new user/role just for this purpose.

[felipesewaybric]

https://answers.splunk.com/answers/289083/how-to-delete-event-data-from-an-indexer-using-the.html

bmacias84: The api does not provide facilities to clean the eventdata as Splunk daemon needs to be stopped. You are better off using remote ssh command or powershell command to run the shell commands. You can use the "|delete" command to mark the data as unsearchable
via the api by create a search job, but that does not remove the data.