We have a Splunk instance that keeps copies of Jira tickets which have changed over time. Anytime there is a change to a ticket, we journal most of the JSON object into Splunk as an event. Our index is getting large, and I think that it is affecting performance (nearly 1,000,000 events and 1 GB). For each ticket id, I want to delete all but 1 event that is older than 6 months (keep the youngest event that is > 6 mon old). index=jira latest=-6mon | dedup key (Gets the list of keys with events that can be deleted) For each key, delete all but one of the events > 6mon (e.g. KEY-75) index=jira latest=-6mon key = "KEY-75" | streamstats count as result | where result > 1 | delete Error in 'delete' command: This command cannot be invoked after the command 'simpleresultcombiner', which is not distributable streaming. The search job has failed due to an error. You may be able view the job in the Job Inspector. index=jira latest=-6mon key = "KEY-75" | sort - _time | streamstats count as result | where result > 1 | delete Error in 'delete' command: This command cannot be invoked after the command 'sort', which is not distributable streaming. The search job has failed due to an error. You may be able view the job in the Job Inspector.
... View more
