index duplication

[code_nomad]

is there any way to delete/remove indexed data for a particular time range ? thanks in advance.

[MHibbin · Accepted solution]

You can filter you indexes to the events you wish to remove in the standard Splunk search view (i.e. flashtimeline). For example:

 <your filtering search> | delete

As this is "risky", the user will need to be assigned the "can_delete" role.

If it is in specific indexes, and you wish to remove that WHOLE index, you can use the CLI tool, "clean", to delete data from that Index. For example

./splunk clean eventdata ...

These methods should be used with extreme caution as the effects can not be reversed. I would recommend reviewing your filtering search carefully, and also reading the documenatation on this subject first... it should not be taken lightly.

http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/RemovedatafromSplunk

[piebob]

(i accepted your answer, mhibbin :))

[MHibbin]

... it's the empty tick next to the answer

[MHibbin]

no problem... if this answers your question, can you please mark it as accepted to "close" it off.

[code_nomad]

thank you !!