×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
vtrend
Engager
Member since: ‎08-11-2021
‎08-11-2021
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎08-11-2021
Activity Feed
Topics I've Started
View All

Re: How to delete indexed data from disk?

by in Getting Data In
‎08-11-2021 05:54 PM
‎08-11-2021 05:54 PM
@venkatasri  Ohh, this explains it. I'll try this and update here with the results. Thanks a lot. ... View more

Re: How to delete indexed data from disk?

by in Getting Data In
‎08-11-2021 05:46 PM
‎08-11-2021 05:46 PM
Yes, I have added local data directory with the path "/data/01/" and "Indexed Once' again. I chose same Index and App Context while re-ingesting. However when I submit and complete above steps, the search query gives 0 results. index='telemetry' source='/data/01/*' ... View more

Re: How to delete indexed data from disk?

by in Getting Data In
‎08-11-2021 05:39 PM
‎08-11-2021 05:39 PM
@venkatasri  Thanks Venkat for helping me out. I tested by re-ingesting same data but Splunk is not indexing it back, the job runs, but no results. Searching around the forums, few users mentioned I need to either clean the index or delete fishbuckets etc which I was trying to avoid. ... View more

How to delete indexed data from disk?

by in Getting Data In
‎08-11-2021 04:33 PM
‎08-11-2021 04:33 PM
I have an index = 'telemetry' which gets data from a local directory on standalone Splunk installation. I deleted some data from above index which came in from particular directory using command index='telemetry'  source="/data/01/*" | delete The above index has still more data from other sources (e.g. "/data/02" ..) I want to re-index the data from deleted directory i.e. "/data/01" again. Running splunk clean eventdata involves deleting entire index. I want to wipe from disk only that part of data that has been deleted above so that I can re-index it back. How can I achieve this?   ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎08-11-2021 09:16 PM
Karma given to
View All