Splunk Enterprise

How to delete the actual data?

WildHuckleberry
Path Finder

Hello Splunkers! 

 

I used the | delete command to delete the data, but to my knowledge, the actual data is still in the storage. 

 

 

Therefore, is it possible to delete the actual data that I deleted in search??

 

Thank you in advance. 🥸

 

Labels (2)
0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Sadly, the official solution is to use delete. And wait for the data to age out.

View solution in original post

cpetterborg
SplunkTrust
SplunkTrust

There are ways to remove the data from the buckets, but if the buckets are flagged for bucket integrity checking

enableDataIntegrityControl=true

then it will effectively render the buckets useless in splunk. If you are planning no trying some method to delete the data, you should know that it can result in difficulties. If it is very sensitive data, delete the buckets with the data, but don't edit the buckets.

I was asked to see if I could modify buckets and no one know. I was successful, but they didn't have the integrity checking set up, so that was possible. If you have something like passwords and you are needing to maintain security, you will have to delete the buckets. I've had to do that before as well. Losing data isn't fun, but if it means being truly secure, you may have to bite the bullet.

WildHuckleberry
Path Finder

Thank you for your reply. 

 

I will definitely try this as well!

0 Karma

burwell
SplunkTrust
SplunkTrust
0 Karma

WildHuckleberry
Path Finder

Hello @burwell ! 

 

Thank you for your answer! 

 

The clean command looks like to delete the whole data. 

We just need to remove the data we deleted by using the | delete command. 

 

is there any way to delete the specific data? 

0 Karma

burwell
SplunkTrust
SplunkTrust

Sadly, the official solution is to use delete. And wait for the data to age out.

PickleRick
SplunkTrust
SplunkTrust

No. Splunk can mark the events as unsearchable with delete command but there is no way to remove single events from a bucket. At least there is no official user-available way to do so.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...