How to delete the actual data?

[WildHuckleberry]

Hello Splunkers! 

I used the | delete command to delete the data, but to my knowledge, the actual data is still in the storage. 

Therefore, is it possible to delete the actual data that I deleted in search??

Thank you in advance. 🥸

[cpetterborg]

There are ways to remove the data from the buckets, but if the buckets are flagged for bucket integrity checking

enableDataIntegrityControl=true

then it will effectively render the buckets useless in splunk. If you are planning no trying some method to delete the data, you should know that it can result in difficulties. If it is very sensitive data, delete the buckets with the data, but don't edit the buckets.

I was asked to see if I could modify buckets and no one know. I was successful, but they didn't have the integrity checking set up, so that was possible. If you have something like passwords and you are needing to maintain security, you will have to delete the buckets. I've had to do that before as well. Losing data isn't fun, but if it means being truly secure, you may have to bite the bullet.

[WildHuckleberry]

Thank you for your reply. 

I will definitely try this as well!

[burwell]

Looks like you are looking for the clean command

https://docs.splunk.com/Documentation/Splunk/8.2.4/Indexer/RemovedatafromSplunk

[WildHuckleberry]

Hello @burwell ! 

Thank you for your answer! 

The clean command looks like to delete the whole data. 

We just need to remove the data we deleted by using the | delete command. 

is there any way to delete the specific data? 

[burwell · Accepted solution]

Sadly, the official solution is to use delete. And wait for the data to age out.

[PickleRick]

No. Splunk can mark the events as unsearchable with delete command but there is no way to remove single events from a bucket. At least there is no official user-available way to do so.