Splunk Search

Delete logs

anil1432
Explorer

Hi All,

How can I delete my logs permanently

 

Request to delete old Splunk logs for EMS and Truvue webservices that are older than 05/17/2021.
* Long Description
Request to delete old Splunk logs for EMS (App id: 2926) and Truvue webservices (App id: 637) that are older than 05/17/2021 as required by Experian GSO as these
logs contained plain text Pll data.
As part of an Insider Threat audit currently being performed the following Splunk index was flagged as containing clear text Pll data originating from a production
host.
eits_ec_prod_us
Items in Index: Name/Address/DOB/SSN
Host names:
mckecpap043v
mckecpap044
I
alnecsap456V
alnecsap455v
Source = /logs/TRUVUEWS_V6/TRUVUEWS_V6-std.log

Labels (1)
0 Karma
1 Solution

eichfuss
Path Finder

Hey @anil1432 
you can filter your logs in the search (i.e. index=xyz host=xyz) and set the time selection (i.e. Date Range - Between - 17/05/2021 00:00:00 and 17/05/2021 24:00:00) and then type the "| delete" command, then the filtered events will me deleted (marked as deleted). The Data / events are still on the Storage / in the Index.

View solution in original post

0 Karma

danielcj
Communicator

Hi,
You have to create a search that returns only the results that should be deleted (correct search terms and correct time range). After that, you should add the "delete" command.
Example:

<your_search> | delete


The data is not removed from the index, but it will not be returned on future searches. To use the command you need to run the search with an user with a role with capability "delete_by_keyword"

 

0 Karma

anil1432
Explorer

So I need to delete only events from my from my logs. i.e from 17/05/2021 to delete events . How can I ? 

 

0 Karma

eichfuss
Path Finder

Hey @anil1432 
you can filter your logs in the search (i.e. index=xyz host=xyz) and set the time selection (i.e. Date Range - Between - 17/05/2021 00:00:00 and 17/05/2021 24:00:00) and then type the "| delete" command, then the filtered events will me deleted (marked as deleted). The Data / events are still on the Storage / in the Index.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...