This works for me:
source=
Your user would of course need 'can delete' privs.
is this data in a certain index? is there any other data in this index that you do not want to delete?
Then there really is no easyer way to do this. Using the | delete command would be the best choice, and once data rolls to frozen it will then completely get deleted.
Otherwise if you do not care for the data on a certain index you can use the ./splunk delete eventdata
(note, all data in that index will be removed).
To remove the file from being indexed again go to your manager page and head to:
Manager » Data inputs » Files & Directories
then disable the file that you do not want to index anymore.
Hope this helps,
.gz
Both. Not sure if it matters, but it is a stand-alone file.
You can selectively delete events via keyword searches by using the delete command:
http://www.splunk.com/base/Documentation/latest/SearchReference/Delete
I want to delete the entire data and wipe it out completely. My understanding is that Delete command will hide data but it does not remove the data permanently.
Please clarify the question... Are you trying to delete data from the index, or are you trying to delete the input itself?