Splunk Enterprise

Delete existing Splunk Light events/logs from web-interface

avmik
New Member

I know about "splunk clean eventdata ...", but I want to do this action from web-interface. It's very important feature with many devices, I think. And also, I want to give some names for my IP-hosts without DNS in Splunk. Will I ever see it? Please, developers...

0 Karma

ppablo
Community Manager
Community Manager

Hi @avmik

Making a feature request on Answers isn't the best way to get it to happen unfortunately.

You can submit formal enhancement requests through:

http://www.splunk.com/index.php/submit_issue

and enter it just like a support ticket, but choose an "enhancement" option.

0 Karma

neelamssantosh
Contributor

Hey avmik,

2nd Method:
Yes we can delete the data virtually i.e, the metadata will be deleted from Indexers so that the data can't be searchable.
Note: Your index size and events will remain same size as before along with buckets.

at the end of your query add 'by clause' with delete command
eg: if you have 110hosts and you want to see only 2hosts data,
index=xxxx_index NOT host=xxx_1 NOT host=xxx_2|delete

Hope it can help you.

fdi01
Motivator

in splunk home go to :
settings > Data imputs > Files & directories
>Remote event log collections
> Local event log collection
........
you select your Data imputs type,

you go on data or event data you want to delete and delete it see picture below:
alt text

note: you can't delete default data splunk or events.

sorry for my english.

acharlieh
Influencer

This will prevent any new data coming in for that input, however, it would not remove any already indexed data (what clean eventdata does)