Splunk Search

Why is it called delete when it doesn't delete, but hide data?

New Member

I find this very ridiculous considering that the terminology used is not accurate in what it is doing. When doing a search to hide data from being searchable, it calls it delete. Well it's not deleting the data from the logs so its essentially a misnomer calling the function delete. Instead either call it hide or removeFromSearch - some other name that gives it meaning.

I've spent the last 2 hours searching how to reclaim disk space without removing the primary index - its not possible and people have been requesting this kind of utility for years! Naming conventions mean a lot. They carry a lot of meaning and seeing this kind of misnomer is really frustrating.

Labels (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!