Security

Is it possible to delete a specific user's data once its indexed?

mallempatisreed
Explorer

hi Team,

Would like to check if it is possible to delete a specific user's data once it gets indexed. If the data is in multiple indexes and sourcetypes which we are aware of then is it possible?

Thanks,
Sree

Tags (2)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@mallempatisreedhar,

You can use delete command to delete specific data from index. However , it does not reclaim disk space. It marks all of the events returned by the search as deleted. Subsequent searches do not return the marked events.

To delete run a search that returns the events you want to delete. Make sure that the search returns ONLY the events that you want to delete, and no other events. After you confirm that the results contain the data that you want to delete, pipe the search to the delete command.

Have a look at the documentation for more information : delete

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @mallempatisreedhar,

Did the answer below solve your problem? If so, please resolve this post by approving it!

If your problem is still not solved, keep us updated so that someone else can help ya.

Thanks for posting!

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@mallempatisreedhar,

You can use delete command to delete specific data from index. However , it does not reclaim disk space. It marks all of the events returned by the search as deleted. Subsequent searches do not return the marked events.

To delete run a search that returns the events you want to delete. Make sure that the search returns ONLY the events that you want to delete, and no other events. After you confirm that the results contain the data that you want to delete, pipe the search to the delete command.

Have a look at the documentation for more information : delete

View solution in original post

0 Karma

mallempatisreed
Explorer

Thanks @renjith.nair

One query!

In the above you have mentioned "it does not reclaim disk space" . If we use the delete command and delete the events for a specific user related data then from GDPR perspective can we say that the Customer data has been deleted from the system and no way to replicate the data.

Thanks,
Sreedhar

0 Karma

koshyk
Super Champion

you can still see the data via backend if you do vi/more the file. I guess most of the big data systems, the atomic delete is not that simple.

If you really want to delete the data, you need to ensure such data goes into specific index. and ensure the data is expired after 30days etc.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!