Unable to delete events?

[remy06]

I've tried to delete events for a particular source,say source="tcp:1234" | delete

The operation was successful.However after I returned to the search summary page, there are events still listed with that source..

When I clicked on it, it takes me to search page but indicate '0 matching events'.

Is it a bug?

[Paolo_Prigione · Accepted solution]

The "delete" command doesn't really delete the events from the index: it marks them so that they are not displayed anymore as search results. Unluckily right now, the index metadata are not updated, so those events are still presents in the summary page.

The only way to phisically erase events is to clean-up the index but that is not selective.

[remy06 · Accepted solution]

Thanks. I've noticed it takes a while for the events to be displayed as '0'. Are we able to or is it safe enough to remove those '0' entries from Hosts.data,SourceType.data, Sources.data ?

[gkanapathy]

You should not under usual circumstances edit those files by hand. They will be updated by Splunk automatically.

[Paolo_Prigione · Accepted solution]

The "delete" command doesn't really delete the events from the index: it marks them so that they are not displayed anymore as search results. Unluckily right now, the index metadata are not updated, so those events are still presents in the summary page.

The only way to phisically erase events is to clean-up the index but that is not selective.

[gkanapathy]

Other (much more complicated and often infeasible) options are to export selectively, and reimport, or to drop and re-index data from either an original source or a partial export. There are no general instructions because the ability to do this is specific to you situation.