I have a saved search scheduled to write to a summary index. How do I clear the summary index each time before the saved search is run again?

[teekayx]

I have a saved search cron-scheduled to run every hour. This will write to a summary index each time. I want to clear the summary index each time before the saved search is run again.

I tried to cron-schedule another saved search just for this -- index=summary | delete -- 1 min before the above search runs. However, delete happens a lot quicker and I have a 1 min window now which fetches no result from the summary index.

Can I add -- append [ index=summary | delete ] -- to the first saved search to achieve this in one go?

[TheWoodRanger]

,The "delete" command just makes the events unsearchable, it doesn't remove them from the Summary Index. If space is an issue, be wary of this as the size of the index will still include all of the events deleted using | delete

"Using the delete command marks all of the events returned by the search as deleted. Subsequent searches do not return the marked events. No user, not even a user with admin permissions, is able to view this data after deletion. The delete command does not reclaim disk space."

[teekayx]

Thanks. I find it strange though to have a 'delete' command that does not delete! (kind of anti-semantic) and to not even have a way to recover such soft-deleted content. What's the point of having such an inflexible delete command!

[teekayx · Accepted solution]

I did this and this works. I was a bit scared to test it out then as I was a rookie then. I am closer to being a ninja now.