Hi All,
So I'm wondering if it's possible to use a python script that runs on a schedule to delete all the content of an index.
Thanks!
Hi @ejespiritu
Take a look at the Delete command, here is the link.
https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Delete
You can make this as a scheduled search, make it run frequently to delete the data.
& another thing to remind of is, you need to have delete permissions enabled for you role to delete the data from index ( delete permissions are separate from admin permissions )
Thank you
Hi @ejespiritu
Take a look at the Delete command, here is the link.
https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Delete
You can make this as a scheduled search, make it run frequently to delete the data.
& another thing to remind of is, you need to have delete permissions enabled for you role to delete the data from index ( delete permissions are separate from admin permissions )
Thank you
Do you want the data to be deleted permanently from the index (disk) or just want it to be unsearchable while still retaining the data on the indexes (disks).
delete permanently as i need it to be replaced as a whole every month
yes, as @PowerPacker pointed out below, you can run a scheduled search and set "run script" in alert actions to delete the index.