Knowledge Management
Highlighted

How to delete events from a summary-index?

Legend

Hi,

Is it possible to delete some events (not the full index) from a summary index?
something like | delete command?

Thank you.
Giuseppe

0 Karma
Highlighted

Re: How to delete events from a summary-index?

Motivator

Hi cusello,

Yes you can delete the events using | delete command, make sure that you are adding the pipe right after your base search. Here are the delete command description and the link,

Description

Makes events irretrievable from the Splunk Enterprise indexes.
Caution: Removing data is irreversible. If you want to get your data back after the data is deleted, you must re-index the applicable data sources.

Ref: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delete

Hope this will helps you.

Thanks,
V

View solution in original post

Highlighted

Re: How to delete events from a summary-index?

Esteemed Legend

You may not have permission to use the delete command.

0 Karma
Highlighted

Re: How to delete events from a summary-index?

Motivator

Perfect point.

0 Karma
Highlighted

Re: How to delete events from a summary-index?

Legend

Excuse me, but I probably misspoke!
My problem is that I loaded wrong events in a tsidx index using the tscollect command (BlueCoat App) and now I don't know how to delete them because I cannot use the "| delete" command after a non-streaming command 'tstats'.
How can I search events loaded in a tsidx index and delete them?
Thank you.
Bye.
Giuseppe

0 Karma
Highlighted

Re: How to delete events from a summary-index?

Motivator

Post your search

0 Karma
Highlighted

Re: How to delete events from a summary-index?

Legend

The load search is:

`bcoat_request`| rex field=source "(?(Proxy|Users)_.*)" | table _time action bytes_in bytes_out category cs_uri_path cs_uri_scheme cs_uri_extension dest_host filter_result http_content_type http_referrer http_user_agent sc_status src_ip src_user x_bluecoat_application_name x_virus_id dvc_ip proxysource | tscollect namespace=bluecoat_stats

It's the Splunk App for BlueCoat standard load search, the only difference is that I extract an additional field ( proxysource ).
Thank you.
Bye.
Giuseppe

0 Karma