we need to delete three files from the index
I have used the |delete command to clean the indexed data and it’s deleted but still its showing under the source field.
source='/var/log/splunk/syslog/******/********' | delete
source='/var/log/splunk/syslog/******/********' | delete
source='/var/log/splunk/syslog/******/********' | delete
Hi @kiranpanchavat1,
the delete command makes only a logical deleting of the events but it doesn't remove the deleted events from the buckets.
If you want to fully clean an index you can use the command
./splunk clean eventdata -index <your_index>
if you want to remove all the entire buckets where the latest event exceeds a retention time, you could change the retention time for that index, wait for the deletion of old data and the set up again the the correct retention time disk.
It isn't possible to physically delete only a part of events in a bucket.
Ciao.
Giuseppe
See, my data is stored in one index and in that index there are so many data is storing so i need to delete only the particular files
Hi @kiranpanchavat1,
if you're speaking of delete an entire bucket, in Community there are some examples of deleting buckets but I didn't directly tested:
If instead you want to delete only a part of a bucket it isn't possible, you can only make a logical deletion (delete command).
Ciao.
Giuseppe
@gcusello Can you provide me the btprobe command details
What do you mean by "still showing under the source field"?
Also, you know that delete doesn't physically remove the data from index files? Just marks them as inaccessible.