Remove (delete) data

Remove (delete) data

With Splunk's tools, you can remove:

• indexed event data from an index
• global data in Splunk's hash database (tags, aliases)
• user account data (all of your created user accounts)
• all of the above data at once to return your Splunk installation to its original shipping state
• events from searches

Note: You must have admin level privileges to remove data.

You have two main options when removing data from Splunk:

• Use the clean command in the CLI to completely remove data (event, global, and user data) from the index. Typically, you do this before re-indexing all your data.
• Use the delete:: modifier to specify that certain events not appear in search results. Because delete:: is slower than clean, use it only if you wish to re-index a small subset of your data sources--perhaps you want to reconfigure timestamp recognition for a single data source before re-indexing it. For example, delete events from the source "foo" (delete::source::foo) if you wish to re-index the source "foo".

Caution: Removing data is irreversible. Use caution when choosing what events to remove from searches, or what data to remove from your Splunk installation. If you want to get your data back, you must re-index the applicable data source(s).

The CLI command: clean

The clean CLI command deletes event data, global data, and user account data from your Splunk installation. clean takes the following arguments: eventdata, globaldata, userdata, and all.

Add the -f parameter to force clean to skip its confirmation prompts.

Note: Type ./splunk help clean to access the help page for clean while in the CLI.

Remove event data from an index

Permanently remove event data from an index on your Splunk installation by typing ./splunk clean followed by the eventdata argument. Specify an index to delete event data from a specific index. If you don't specify an index, Splunk deletes all event data from all indexes.

Examples:

This example tells Splunk to remove event data in all indexes (because no index argument is specified).

./splunk clean eventdata 

This example removes indexed event data from the internal index and forces Splunk to skip the confirmation prompt.

./splunk clean eventdata internal -f

Remove global data

Remove global data (tags and source type aliases for events you've indexed) from your Splunk installation by typing ./splunk clean followed by the globaldata argument.

Examples:

This example removes the global data for all indexed events.

./splunk clean globaldata

This example removes the global data for all indexed events and forces Splunk to skip the confirmation prompt.

./splunk clean globaldata -f

Remove user data

Remove user data (user accounts you've created) from your Splunk installation by typing ./splunk clean followed by the userdata argument.

Examples:

This example removes all of the user accounts you've created.

./splunk clean userdata

This example removes the user accounts you've created and forces Splunk to skip the confirmation prompt.

./splunk clean userdata -f

Remove all data

Remove all global, user, and indexed event data to return Splunk to its original installation state by typing ./splunk clean followed by the all argument.

Examples:

This example removes all global, user, and indexed event data.

./splunk clean all

This example removes all global, user, and indexed event data you've created and forces Splunk to skip the confirmation prompt.

./splunk clean all -f

Remove events from search results

Use the delete:: modifier to remove events from search results based on an indexed field value, or matching a string. Access the delete:: modifier by piping any search to the oldsearch command.

The delete:: modifier doesn't delete events from the index; it masks events from being displayed in search results by tagging them with a value in the index that makes them unsearchable.

Caution: Removing data is irreversible. Use caution when choosing what events to remove from searches, or what data to remove from your Splunk installation. If you want to get your data back, you must re-index the applicable data source(s).

Note: oldsearch is the deprecated version of the search command.

Syntax

search | oldsearch delete::(host | source | sourcetype)::value

• You must express all fields, and values in the argument of delete completely in lowercase.
• You can remove events based on values of any indexed field.
• You can also remove events that match a string (delete::<string>) instead of matching a field::value pair. The strings can't contain any spaces or commas, and you can't specify multiple strings in a single argument.

Examples:

This example searches for "foo" and removes events of sourcetype=bar from the search results.

This example searches for "foo" and removes events from the host "webserver1".

• Was this topic useful?
• Post a comment