Splunk Search

Messed up input data ruining/slowing down search?

monicato
Path Finder

Hi!

I accidentally indexed really bizarre logs (partially downloaded logs) and assigned it to a sourcetype. Now searches in this sourcetype is extremely slow and I get inconsistent and bizarre results. I then deleted them from my input directory but it seems like they still exist. Is there anyway to clear or erase the history?

I used the | delete command and it looks like it's gone, but my search is still messed up and extremely slow (it takes a long time to output results)... Can anyone tell me what's going on?

please help ;__;

0 Karma
1 Solution

MHibbin
Influencer

Not sure "what's going on?", but for you question in cleaning your "history", I assume you mean events/eventdata, this can be done by using the CLI command "$SPLUNK_HOME/bin/splunk clean". Before using this, you should read the documentation, as you will lose ALL data in the indexes you choose to clean..

http://docs.splunk.com/Documentation/Splunk/latest/Admin/RemovedatafromSplunk

Once you have cleaned a specific index (e.g. main), you may wish to re-index certain files that were previously monitored, as Splunk maintains a record of what it has indexed through CRC checks,etc, you may also need to look in to cleaning the fishbucket... BUT BE WARNED, this could result in duplicated data in other indexes.

Hope this helps,

MHIbbin

View solution in original post

wilsonchua
New Member

I did a 'clean' operation but the issue is still the same.
Running a search query for the "last 15 minutes" takes more than 25 minutes to complete.
Any ideas would be appreciated.

0 Karma

MHibbin
Influencer

Not sure "what's going on?", but for you question in cleaning your "history", I assume you mean events/eventdata, this can be done by using the CLI command "$SPLUNK_HOME/bin/splunk clean". Before using this, you should read the documentation, as you will lose ALL data in the indexes you choose to clean..

http://docs.splunk.com/Documentation/Splunk/latest/Admin/RemovedatafromSplunk

Once you have cleaned a specific index (e.g. main), you may wish to re-index certain files that were previously monitored, as Splunk maintains a record of what it has indexed through CRC checks,etc, you may also need to look in to cleaning the fishbucket... BUT BE WARNED, this could result in duplicated data in other indexes.

Hope this helps,

MHIbbin

monicato
Path Finder

Thanks for the answer! I identified the source of the weird log and piped it to the delete command and that did the trick! No need to clear the index. Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...