How do I remove indexed data? Such as specific da... - Splunk Community

Splunk Search

How I can I remove specfic indexed data from an exsiting data index?

You can delete specific indexed data using the delete command. So in your case, you might do:

sourcetype=my_sourcetype | delete

Note that you will need to have the can_delete role and that this process is irreversible. This will NOT create disk space.

Check out http://www.splunk.com/base/Documentation/4.1.1/Admin/RemovedatafromSplunk

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...