How to delete data based on search results in 3.4.14 for Windows?

[straffin]

I'd like to remove all data that matches a given search from my Splunk 3.4.14 for Windows install. I've found Windows-centric examples for earlier versions that don;t work for 3.4.14 (at http://www.splunk.com/base/Documentation/3.1.3/Admin/DeleteDataFromTheIndex) and 3.4.14-centric examples that don't work under Windows (at http://www.splunk.com/base/Documentation/3.4.14/Admin/RemoveDeleteData)

Anyone know what I need to do to delete indexed data based on search results in 3.4.14 for Windows?

[straffin]

I tried replacing the single-quotes with double-quotes...

C:\Program Files\Splunk\bin>splunk search " | oldsearch delete::sourcetype::WinRegistry"

... and it appears to be working fine.

(There was an error at the end about exceeding the maximum time limit, but it worked nonetheless.)

[straffin]

Well now I feel like a total newb. 😕 After trying some other things, I had simply tried the command as listed in the 3.4.14-centric article listed above and, when it failed, I (in frustration) moved on to more searching and asking here. Just now, I tried replacing the single-quotes with double-quotes...

C:\Program Files\Splunk\bin>splunk search " | oldsearch delete::sourcetype::WinRegistry"

... and it appears to be working fine. Thanks for the encouragement to look at it again, anyway. 🙂

[gkanapathy]

Please indicate exactly what you typed in Windows, and what error you received. While http://www.splunk.com/base/Documentation/3.4.14/Admin/RemoveDeleteData#Remove_events_from_search_res... shows a non-Windows example, but the functionality will be identical, though of course as noted there you will have to correct the shell syntax (in particular directory separators and quotes) for it to work.