Scrub data from Splunk

[qas]

Splunk's scrub command scrub data in queries/report. What are the steps to permanently remove certain logs from Splunk? I imagine it'd require re-generating the index.

[stefanlasiewski]

Also see http://splunk-base.splunk.com/answers/2476/how-do-i-reclaim-disk-space-after-a-massive-delete-operat...

[dwaddle]

You can take a search and | delete to delete the results of that search from the index. Your account needs the can_delete privilege. Strictly speaking, this does not remove it from the index so much as mark it as deleted. It remains in the on-disc bucket structure and could be located in there using traditional filesystem tools - but it would not be searchable in Splunk any more.

[gkanapathy]

To really clean, you would have to export the data you want to keep out of the index using command line exporttool or splunk export (possibly after doing | delete) then import back in with importtool or splunk import.