How do I remove indexed data? Such as specific data source?

[clyde772]

How I can I remove specfic indexed data from an exsiting data index?

[Simeon]

You can delete specific indexed data using the delete command. So in your case, you might do:

sourcetype=my_sourcetype | delete

Note that you will need to have the can_delete role and that this process is irreversible. This will NOT create disk space.

[rroberts]

Check out http://www.splunk.com/base/Documentation/4.1.1/Admin/RemovedatafromSplunk