Delete old logs and personal data of former employee?

[ashiq1993]

In a nutshell AZ T rade received a request to delete some personal data from a former contractor. we have to delete data linked to ****(employee name) older than a year. 

In which it is necessary to delete data and logs dating back more than a year concerning ****(Employee name).

How can we do that to delte old personal data and logs dating back more than a year of an ex-employee?

[richgalloway]

Data indexed in Splunk cannot be deleted selectively.  It will remain in the index until it ages out or is removed to make room for new data.

You can, however, hide the data so it never appears in search results.  To do that, you'll have to grant someone the can_delete role.  Then that person will have to craft a Splunk query that finds the employee's data.  Once satisfied with that search, add | delete on the end of the query to mark the events as invisible.