Splunk Enterprise
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Splunk Platform
- :
- Splunk Enterprise
- :
- index duplication
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
code_nomad
New Member
11-02-2012
04:14 AM
is there any way to delete/remove indexed data for a particular time range ? thanks in advance.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MHibbin
Influencer
11-02-2012
04:36 AM
You can filter you indexes to the events you wish to remove in the standard Splunk search view (i.e. flashtimeline). For example:
<your filtering search> | delete
As this is "risky", the user will need to be assigned the "can_delete" role.
If it is in specific indexes, and you wish to remove that WHOLE index, you can use the CLI tool, "clean", to delete data from that Index. For example
./splunk clean eventdata ...
These methods should be used with extreme caution as the effects can not be reversed. I would recommend reviewing your filtering search carefully, and also reading the documenatation on this subject first... it should not be taken lightly.
http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/RemovedatafromSplunk
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MHibbin
Influencer
11-02-2012
04:36 AM
You can filter you indexes to the events you wish to remove in the standard Splunk search view (i.e. flashtimeline). For example:
<your filtering search> | delete
As this is "risky", the user will need to be assigned the "can_delete" role.
If it is in specific indexes, and you wish to remove that WHOLE index, you can use the CLI tool, "clean", to delete data from that Index. For example
./splunk clean eventdata ...
These methods should be used with extreme caution as the effects can not be reversed. I would recommend reviewing your filtering search carefully, and also reading the documenatation on this subject first... it should not be taken lightly.
http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/RemovedatafromSplunk
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
piebob
Splunk Employee
12-27-2012
01:59 PM
(i accepted your answer, mhibbin :))
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MHibbin
Influencer
11-02-2012
05:19 AM
... it's the empty tick next to the answer
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MHibbin
Influencer
11-02-2012
05:18 AM
no problem... if this answers your question, can you please mark it as accepted to "close" it off.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
code_nomad
New Member
11-02-2012
05:09 AM
thank you !!
Get Updates on the Splunk Community!
Aligning Observability Costs with Business Value: Practical Strategies
Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...
Mastering Data Pipelines: Unlocking Value with Splunk
In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...
Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0
Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...
