Delete existing Splunk Light events/logs from web-interface

[avmik]

I know about "splunk clean eventdata ...", but I want to do this action from web-interface. It's very important feature with many devices, I think. And also, I want to give some names for my IP-hosts without DNS in Splunk. Will I ever see it? Please, developers...

[ppablo]

Hi @avmik

Making a feature request on Answers isn't the best way to get it to happen unfortunately.

You can submit formal enhancement requests through:

http://www.splunk.com/index.php/submit_issue

and enter it just like a support ticket, but choose an "enhancement" option.

[neelamssantosh]

Hey avmik,

2nd Method:
Yes we can delete the data virtually i.e, the metadata will be deleted from Indexers so that the data can't be searchable.
Note: Your index size and events will remain same size as before along with buckets.

at the end of your query add 'by clause' with delete command
eg: if you have 110hosts and you want to see only 2hosts data,
index=xxxx_index NOT host=xxx_1 NOT host=xxx_2|delete

Hope it can help you.

[fdi01]

in splunk home go to :
settings > Data imputs > Files & directories
>Remote event log collections
> Local event log collection
........
you select your Data imputs type,

you go on data or event data you want to delete and delete it see picture below:

note: you can't delete default data splunk or events.

sorry for my english.

[acharlieh]

This will prevent any new data coming in for that input, however, it would not remove any already indexed data (what clean eventdata does)