How to remove some indexed data

[volkergersabeck]

Hi,

we're using the free license of splunk and are very happy with it. Unfortunately, our application ran into this bug (https://issues.apache.org/bugzilla/show_bug.cgi?id=44178) which caused our search index to be flooded with exception logs. Due to that our search is now disabled because the splunk index is too large. Is there a way to delete these exceptions from the index to bring it below the limit again? Since I don't want to loose the other logs I can't delete the complete index. I can't use the delete command in the search, because the search is disabled due to the license violation.

Is there any way to do this?

Thanks

[gkanapathy]

Deleting the data (even if you could) will not reset the license. The violation is not based on the amount of data in the index, but on how much was indexed during the day, and that can not be undone. You can clear the violation only by cleaning all the data, a license reset key, or waiting until after the window has passed.

[RicoSuave]

yes, run a search that will return only those events and just pipe it to delete. Assuming you have the can_delete permissions, this should work

example: mysearch | delete

[gkanapathy]

It also doesn't matter if you delete the data. The license violation is not based on how much data is in the index, but how much was indexed during the day. That has already occurred. The only ways to clear the violation are to completely delete all the data ("./splunk clean all"), install a license reset key, or wait until the violations are outside of the rolling 30-day window.

[volkergersabeck]

Because of the license violation I'm not able to run a search. That's why I'm unable to delete the data. I'm using the admin user, so I guess I have the permission set, but the search itself doesn't work.