Is it possible to delete a specific user's data once its indexed?

[mallempatisreed]

hi Team,

Would like to check if it is possible to delete a specific user's data once it gets indexed. If the data is in multiple indexes and sourcetypes which we are aware of then is it possible?

Thanks,
Sree

[mstjohn_splunk]

hi @mallempatisreedhar,

Did the answer below solve your problem? If so, please resolve this post by approving it!

If your problem is still not solved, keep us updated so that someone else can help ya.

Thanks for posting!

[renjith_nair · Accepted solution]

@mallempatisreedhar,

You can use delete command to delete specific data from index. However , it does not reclaim disk space. It marks all of the events returned by the search as deleted. Subsequent searches do not return the marked events.

To delete run a search that returns the events you want to delete. Make sure that the search returns ONLY the events that you want to delete, and no other events. After you confirm that the results contain the data that you want to delete, pipe the search to the delete command.

Have a look at the documentation for more information : delete

[mallempatisreed]

Thanks @renjith.nair

One query!

In the above you have mentioned "it does not reclaim disk space" . If we use the delete command and delete the events for a specific user related data then from GDPR perspective can we say that the Customer data has been deleted from the system and no way to replicate the data.

Thanks,
Sreedhar

[koshyk]

you can still see the data via backend if you do vi/more the file. I guess most of the big data systems, the atomic delete is not that simple.

If you really want to delete the data, you need to ensure such data goes into specific index. and ensure the data is expired after 30days etc.