how to delete

[balajsoz]

Hi,

Am using csv file to indexing in splunk ..

I did the search for two days 16/01/2013 to till date and got the results as events.

Now just want to delete the events or records or rows that belongs to 16/01/2013 only.

How to do that?

[Drainy]

Have a look at;

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk#Delete_events_from_f...

You basically need to add the can_delete role to your user and then you can use | delete to mark the events as "deleted". They will persist in the buckets but Splunk won't display them when a user searches. So in your case you can run a search for your date, verify that you have only the data you want to delete on screen and then add the pipe to | delete

[chimbudp]

use the option "|" option to eliminate the value in the Search query