How to delete all data of index using python?

[ejespiritu]

Hi All,

So I'm wondering if it's possible to use a python script that runs on a schedule to delete all the content of an index.

Thanks!

[PowerPacked · Accepted solution]

Hi @ejespiritu

Take a look at the Delete command, here is the link.

https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Delete

You can make this as a scheduled search, make it run frequently to delete the data.

& another thing to remind of is, you need to have delete permissions enabled for you role to delete the data from index ( delete permissions are separate from admin permissions )

Thank you

[soumyasaha25]

Do you want the data to be deleted permanently from the index (disk) or just want it to be unsearchable while still retaining the data on the indexes (disks).

[ejespiritu]

delete permanently as i need it to be replaced as a whole every month

[soumyasaha25]

yes, as @PowerPacker pointed out below, you can run a scheduled search and set "run script" in alert actions to delete the index.