Refine your search:

is it possible to use ."/splunk clean" and only remove the event data in a date range or simply later than a particular date?

asked 20 Oct '10, 23:52

piebob's gravatar image

piebob ♦♦
2.4k1517
accept rate: 33%


3 Answers:

Unfortunately, "splunk clean" is unable to be that specific when it comes to deleting data from an index. It's all-or-nothing : The entire index has to be wiped, or none of it


$SPLUNK_HOME/bin/splunk help clean

The clean command deletes event data, global data, and user account data 
from your Splunk installation. 

Permanently remove event data from an index by typing, "./splunk clean 
eventdata". Set the index parameter to delete event data from a specific 
index. If you don't set an index, Splunk deletes all event data from all 
indexes.

Remove global data (tags and source type aliases for events you indexed) 
from Splunk by typing, "./splunk clean globaldata".

Remove user data (user accounts you've created) from Splunk by typing, 
"./splunk clean userdata".

** Caution: **
Removing data is irreversible. Use caution when choosing what data to 
remove from your Splunk installation. If you want to get your data back, 
you must re-index the applicable data sources.

** Note: **
Add the -f parameter to force clean to skip its confirmation prompts.


 Syntax: 

    clean  eventdata [-f] [-index <name>]

    clean [globaldata|userdata|all] [-f]

 Objects: 

      eventdata    exported events indexed as raw log files

      globaldata   host tags, source type aliases     

      userdata     user accounts

      all          everything on the server

 Required Parameters: 

     eventdata     if no index specified, the default is to clean all 
                   indexes            

 Optional Parameters:

     eventdata     index   name of index whose eventdata should be cleaned
                   f       forces clean to skip its confirmation prompt
                           (Cleaning cannot be undone. Use carefully!)

     globaldata    f       forces clean to skip its confirmation prompt
                           (Cleaning cannot be undone. Use carefully!)

     userdata      f       forces clean to skip its confirmation prompt
                           (Cleaning cannot be undone. Use carefully!)

As jrodman mentions, using the "delete" search command (http://www.splunk.com/base/Documentation/latest/SearchReference/Delete) and/or bucket aging control in indexes.conf (see frozenTimePeriodInSecs in indexes.conf.spec : http://www.splunk.com/base/Documentation/latest/Admin/Indexesconf) might be a better solution to surgically hide or delete events based on their age.

link

answered 20 Oct '10, 23:56

hexx's gravatar image

hexx ♦
7.6k1941
accept rate: 51%

edited 21 Oct '10, 00:03

|delete should work to hide the data. Bucket size controls and planning can get rid data older than a given date offset.. eventually.

link

answered 20 Oct '10, 23:57

jrodman's gravatar image

jrodman ♦
5.8k2515
accept rate: 42%

Don't forget to delete the source file, too, so you don't end up with your license violated after you clean the index up and then splunk considers it empty and starts reindexing the source again.

link

answered 17 Feb, 02:06

kotique's gravatar image

kotique
1
accept rate: 0%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×64
×33
×28
×9

Asked: 20 Oct '10, 23:52

Seen: 1,746 times

Last updated: 17 Feb, 02:06

Copyright © 2005-2012 Splunk, Inc. All rights reserved.