Splunk Search

Unable to delete events?

remy06
Contributor

I've tried to delete events for a particular source,say source="tcp:1234" | delete

The operation was successful.However after I returned to the search summary page, there are events still listed with that source..

When I clicked on it, it takes me to search page but indicate '0 matching events'.

Is it a bug?

Tags (2)
2 Solutions

Paolo_Prigione
Builder

The "delete" command doesn't really delete the events from the index: it marks them so that they are not displayed anymore as search results. Unluckily right now, the index metadata are not updated, so those events are still presents in the summary page.

The only way to phisically erase events is to clean-up the index but that is not selective.

View solution in original post

remy06
Contributor

Thanks. I've noticed it takes a while for the events to be displayed as '0'. Are we able to or is it safe enough to remove those '0' entries from Hosts.data,SourceType.data, Sources.data ?

View solution in original post

remy06
Contributor

Thanks. I've noticed it takes a while for the events to be displayed as '0'. Are we able to or is it safe enough to remove those '0' entries from Hosts.data,SourceType.data, Sources.data ?

gkanapathy
Splunk Employee
Splunk Employee

You should not under usual circumstances edit those files by hand. They will be updated by Splunk automatically.

0 Karma

Paolo_Prigione
Builder

The "delete" command doesn't really delete the events from the index: it marks them so that they are not displayed anymore as search results. Unluckily right now, the index metadata are not updated, so those events are still presents in the summary page.

The only way to phisically erase events is to clean-up the index but that is not selective.

gkanapathy
Splunk Employee
Splunk Employee

Other (much more complicated and often infeasible) options are to export selectively, and reimport, or to drop and re-index data from either an original source or a partial export. There are no general instructions because the ability to do this is specific to you situation.

0 Karma