We have a Splunk instance that keeps copies of Jira tickets which have changed over time. Anytime there is a change to a ticket, we journal most of the JSON object into Splunk as an event. Our index is getting large, and I think that it is affecting performance (nearly 1,000,000 events and 1 GB). For each ticket id, I want to delete all but 1 event that is older than 6 months (keep the youngest event that is > 6 mon old).
index=jira latest=-6mon | dedup key
(Gets the list of keys with events that can be deleted)
For each key, delete all but one of the events > 6mon (e.g. KEY-75)
index=jira latest=-6mon key = "KEY-75" | streamstats count as result | where result > 1 | delete
The delete command will not recover disk space or make your index any smaller. It merely prevents events from appearing in search results. Also, deleting events does not improve search performance.
--- If this reply helps you, Karma would be appreciated.