How do I remove indexed data? Such as specific data source?

1	How I can I remove specfic indexed data from an exsiting data index? search asked 30 Apr '10, 16:43 clyde772 323●11●5●28 accept rate: 0%

2 Answers:

3	Check out http://www.splunk.com/base/Documentation/4.1.1/Admin/RemovedatafromSplunk link answered 30 Apr '10, 16:47 rroberts 1.7k●2●18 accept rate: 45%

You can delete specific indexed data using the delete command. So in your case, you might do:

sourcetype=my_sourcetype | delete

Note that you will need to have the can_delete role and that this process is irreversible. This will NOT create disk space.

link

answered 30 Apr '10, 17:33

Simeon ♦
4.1k●9●10●34
accept rate: 26%

Post your answer

toggle preview

Email:

RSS:

Answers

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

Tags:

search ×1,651

Asked: 30 Apr '10, 16:43

Seen: 4,998 times

Last updated: 30 Apr '10, 17:33