Splunk Search

Messed up input data ruining/slowing down search?

monicato
Path Finder

Hi!

I accidentally indexed really bizarre logs (partially downloaded logs) and assigned it to a sourcetype. Now searches in this sourcetype is extremely slow and I get inconsistent and bizarre results. I then deleted them from my input directory but it seems like they still exist. Is there anyway to clear or erase the history?

I used the | delete command and it looks like it's gone, but my search is still messed up and extremely slow (it takes a long time to output results)... Can anyone tell me what's going on?

please help ;__;

0 Karma
1 Solution

MHibbin
Influencer

Not sure "what's going on?", but for you question in cleaning your "history", I assume you mean events/eventdata, this can be done by using the CLI command "$SPLUNK_HOME/bin/splunk clean". Before using this, you should read the documentation, as you will lose ALL data in the indexes you choose to clean..

http://docs.splunk.com/Documentation/Splunk/latest/Admin/RemovedatafromSplunk

Once you have cleaned a specific index (e.g. main), you may wish to re-index certain files that were previously monitored, as Splunk maintains a record of what it has indexed through CRC checks,etc, you may also need to look in to cleaning the fishbucket... BUT BE WARNED, this could result in duplicated data in other indexes.

Hope this helps,

MHIbbin

View solution in original post

wilsonchua
New Member

I did a 'clean' operation but the issue is still the same.
Running a search query for the "last 15 minutes" takes more than 25 minutes to complete.
Any ideas would be appreciated.

0 Karma

MHibbin
Influencer

Not sure "what's going on?", but for you question in cleaning your "history", I assume you mean events/eventdata, this can be done by using the CLI command "$SPLUNK_HOME/bin/splunk clean". Before using this, you should read the documentation, as you will lose ALL data in the indexes you choose to clean..

http://docs.splunk.com/Documentation/Splunk/latest/Admin/RemovedatafromSplunk

Once you have cleaned a specific index (e.g. main), you may wish to re-index certain files that were previously monitored, as Splunk maintains a record of what it has indexed through CRC checks,etc, you may also need to look in to cleaning the fishbucket... BUT BE WARNED, this could result in duplicated data in other indexes.

Hope this helps,

MHIbbin

monicato
Path Finder

Thanks for the answer! I identified the source of the weird log and piped it to the delete command and that did the trick! No need to clear the index. Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...