Delete old data from an index

[dfarr]

I have Splunk in some separate environments. Before i joined the program Splunk was moved from one system to the others probably by cloning the VM. Now these cloned instances have some legacy data in the main index. Is there a way to delete just the legacy data? I would like to completely remove it vs just hiding it from search if possible. 

My biggest issue is the forwarders showing missing. I am not to worried about the log entries if i can just remove the missing forwarders.

[livehybrid]

Hi @dfarr 

What architecture is your Splunk deployment? If it is a single instance then you might be able to use the 'split-buckets' command in the Splunk CLI to split out the legacy data into a new index, and then set the retention to a low value so that they roll/archive out. This would rely on there being a source/sourcetype or host only present in the legacy data.

For more info on this check out https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.0/ma...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[dfarr]

Thank you for the reply. I had found the split buckets command before, but couldn't get it to run. We are still on 9.4 and it looks like that was added in 10.0. I'll make sure to add version info in future posts. 

[richgalloway]

These are two different problems.

For the first, know that Splunk indexes are immutable.   Data cannot be removed selectively.  My advice is to copy  the desired data to a new index (use the collect command) and then delete the contents of main.

For the second, I presume you're referring to the list of forwarders in the Monitoring Console.  The "missing" forwarders can be removed by clicking the "Rebuild asset list" button.

[dfarr]

Thank you for the information. Yes, the missing forwarders is what i was referencing.  That solved the issue. Ill research the collect command a bit more, Thank you again.