Splunk Enterprise

How to remove some indexed data

volkergersabeck
New Member

Hi,

we're using the free license of splunk and are very happy with it. Unfortunately, our application ran into this bug (https://issues.apache.org/bugzilla/show_bug.cgi?id=44178) which caused our search index to be flooded with exception logs. Due to that our search is now disabled because the splunk index is too large. Is there a way to delete these exceptions from the index to bring it below the limit again? Since I don't want to loose the other logs I can't delete the complete index. I can't use the delete command in the search, because the search is disabled due to the license violation.

Is there any way to do this?

Thanks

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Deleting the data (even if you could) will not reset the license. The violation is not based on the amount of data in the index, but on how much was indexed during the day, and that can not be undone. You can clear the violation only by cleaning all the data, a license reset key, or waiting until after the window has passed.

RicoSuave
Builder

yes, run a search that will return only those events and just pipe it to delete. Assuming you have the can_delete permissions, this should work

example: mysearch | delete

gkanapathy
Splunk Employee
Splunk Employee

It also doesn't matter if you delete the data. The license violation is not based on how much data is in the index, but how much was indexed during the day. That has already occurred. The only ways to clear the violation are to completely delete all the data ("./splunk clean all"), install a license reset key, or wait until the violations are outside of the rolling 30-day window.

volkergersabeck
New Member

Because of the license violation I'm not able to run a search. That's why I'm unable to delete the data. I'm using the admin user, so I guess I have the permission set, but the search itself doesn't work.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...