Splunk Search

Messed up input data ruining/slowing down search?

monicato
Path Finder

Hi!

I accidentally indexed really bizarre logs (partially downloaded logs) and assigned it to a sourcetype. Now searches in this sourcetype is extremely slow and I get inconsistent and bizarre results. I then deleted them from my input directory but it seems like they still exist. Is there anyway to clear or erase the history?

I used the | delete command and it looks like it's gone, but my search is still messed up and extremely slow (it takes a long time to output results)... Can anyone tell me what's going on?

please help ;__;

0 Karma
1 Solution

MHibbin
Influencer

Not sure "what's going on?", but for you question in cleaning your "history", I assume you mean events/eventdata, this can be done by using the CLI command "$SPLUNK_HOME/bin/splunk clean". Before using this, you should read the documentation, as you will lose ALL data in the indexes you choose to clean..

http://docs.splunk.com/Documentation/Splunk/latest/Admin/RemovedatafromSplunk

Once you have cleaned a specific index (e.g. main), you may wish to re-index certain files that were previously monitored, as Splunk maintains a record of what it has indexed through CRC checks,etc, you may also need to look in to cleaning the fishbucket... BUT BE WARNED, this could result in duplicated data in other indexes.

Hope this helps,

MHIbbin

View solution in original post

wilsonchua
New Member

I did a 'clean' operation but the issue is still the same.
Running a search query for the "last 15 minutes" takes more than 25 minutes to complete.
Any ideas would be appreciated.

0 Karma

MHibbin
Influencer

Not sure "what's going on?", but for you question in cleaning your "history", I assume you mean events/eventdata, this can be done by using the CLI command "$SPLUNK_HOME/bin/splunk clean". Before using this, you should read the documentation, as you will lose ALL data in the indexes you choose to clean..

http://docs.splunk.com/Documentation/Splunk/latest/Admin/RemovedatafromSplunk

Once you have cleaned a specific index (e.g. main), you may wish to re-index certain files that were previously monitored, as Splunk maintains a record of what it has indexed through CRC checks,etc, you may also need to look in to cleaning the fishbucket... BUT BE WARNED, this could result in duplicated data in other indexes.

Hope this helps,

MHIbbin

monicato
Path Finder

Thanks for the answer! I identified the source of the weird log and piped it to the delete command and that did the trick! No need to clear the index. Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...