Splunk Enterprise

Delete existing Splunk Light events/logs from web-interface

New Member

I know about "splunk clean eventdata ...", but I want to do this action from web-interface. It's very important feature with many devices, I think. And also, I want to give some names for my IP-hosts without DNS in Splunk. Will I ever see it? Please, developers...

0 Karma

Community Manager
Community Manager

Hi @avmik

Making a feature request on Answers isn't the best way to get it to happen unfortunately.

You can submit formal enhancement requests through:


and enter it just like a support ticket, but choose an "enhancement" option.

0 Karma


Hey avmik,

2nd Method:
Yes we can delete the data virtually i.e, the metadata will be deleted from Indexers so that the data can't be searchable.
Note: Your index size and events will remain same size as before along with buckets.

at the end of your query add 'by clause' with delete command
eg: if you have 110hosts and you want to see only 2hosts data,
index=xxxx_index NOT host=xxx_1 NOT host=xxx_2|delete

Hope it can help you.


in splunk home go to :
settings > Data imputs > Files & directories
>Remote event log collections
> Local event log collection
you select your Data imputs type,

you go on data or event data you want to delete and delete it see picture below:
alt text

note: you can't delete default data splunk or events.

sorry for my english.


This will prevent any new data coming in for that input, however, it would not remove any already indexed data (what clean eventdata does)