Other Usage

Remove future events from index

fabiolabruzzo
Explorer

Hello,

due to a Windows systems with wrong system/date (date was set in 2034) the _internal index in my Splunk environment has this situation

fabiolabruzzo_0-1642084242473.png

There's a way to remove the future events from this index?

 

Thanks a lot

 

Labels (1)
0 Karma

fabiolabruzzo
Explorer

Thanks,

do you mean like this:

 

index=_internal earliest=+1d latest=+15y | delete

?

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, that's the sort of thing, however, be careful that the search returns some rows otherwise the whole index gets deleted. You can do this something like this

index=_internal earliest=+1d latest=+15y
| appendpipe [stats count as events | where events = 0 | eval gobbledygook = random()]
| delete
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use the delete command - you need to create a search to retrieve all the events you want to delete first, and pipe that into the delete command. Be careful, the delete command cannot be undone, so you need to ensure you are deleting the correct events from the correct index, otherwise, you may delete more than you bargained for. Best practice is to have a separate user which has the delete capability and only use that user for deleting and nothing else.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...