How to delete events from a summary-index?

[gcusello]

Hi,

Is it possible to delete some events (not the full index) from a summary index?
something like | delete command?

Thank you.
Giuseppe

[vasanthmss · Accepted solution]

Hi cusello,

Yes you can delete the events using | delete command, make sure that you are adding the pipe right after your base search. Here are the delete command description and the link,

Description

Makes events irretrievable from the Splunk Enterprise indexes.
Caution: Removing data is irreversible. If you want to get your data back after the data is deleted, you must re-index the applicable data sources.

Ref: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete

Hope this will helps you.

Thanks,
V

[woodcock]

You may not have permission to use the delete command.

[Adan12345]

How is "delete" permissions granted to an individual users?

[gcusello]

Excuse me, but I probably misspoke!
My problem is that I loaded wrong events in a tsidx index using the tscollect command (BlueCoat App) and now I don't know how to delete them because I cannot use the "| delete" command after a non-streaming command 'tstats'.
How can I search events loaded in a tsidx index and delete them?
Thank you.
Bye.
Giuseppe

[vasanthmss]

Post your search

[gcusello]

The load search is:

`bcoat_request`| rex field=source "(?(Proxy|Users)_.*)" | table _time action bytes_in bytes_out category cs_uri_path cs_uri_scheme cs_uri_extension dest_host filter_result http_content_type http_referrer http_user_agent sc_status src_ip src_user x_bluecoat_application_name x_virus_id dvc_ip proxysource | tscollect namespace=bluecoat_stats

It's the Splunk App for BlueCoat standard load search, the only difference is that I extract an additional field ( proxysource ).
Thank you.
Bye.
Giuseppe

[vasanthmss]

Perfect point.