There are ways to remove the data from the buckets, but if the buckets are flagged for bucket integrity checking
then it will effectively render the buckets useless in splunk. If you are planning no trying some method to delete the data, you should know that it can result in difficulties. If it is very sensitive data, delete the buckets with the data, but don't edit the buckets.
I was asked to see if I could modify buckets and no one know. I was successful, but they didn't have the integrity checking set up, so that was possible. If you have something like passwords and you are needing to maintain security, you will have to delete the buckets. I've had to do that before as well. Losing data isn't fun, but if it means being truly secure, you may have to bite the bullet.
Hello @burwell !
Thank you for your answer!
The clean command looks like to delete the whole data.
We just need to remove the data we deleted by using the | delete command.
is there any way to delete the specific data?
No. Splunk can mark the events as unsearchable with delete command but there is no way to remove single events from a bucket. At least there is no official user-available way to do so.