Delete data in the Cloud

Available Languages

Updated:September 28, 2026

Document ID:SPLK044745

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

Removing data from Splunk is possible by using the delete command.

First, create the search condition to fetch the events to mark for deletion.
Once the search condition is acceptable, add the delete clause at the end of the command to remove those events from Splunk.

Investigation

Follow this link Remove all data from one or all indexes for better understanding on deleting data in the cloud.

In the Cloud, Splunk does not provide the option to delete via the CLI as part of regular maintenance.

Resolution

However, there are several options to consider:

1. Using | delete command.

First, run a search that returns the events to be deleted. Make sure that this search returns only the events to delete, and no other events. Once certain of that, pipe the results of the search to the delete command.

For example, to remove the events indexed from a source called /fflanda/incoming/cheese.log so that they no longer appear in searches, do the following:

1. Disable or remove that source so that it no longer gets indexed.

2. Search for events from that source in your index:

source="/fflanda/incoming/cheese.log"

3. Look at the results to confirm that this is the data you want to delete.

4. Once you've confirmed that this is the data you want to delete, pipe the search to delete:

source="/fflanda/incoming/cheese.log" | delete

Please note: The delete command can only be run by a user with the "delete_by_keyword" capability .

2. Send the data through a heavy forwarder, and control what is sent to the cloud via props.conf and transforms.conf.

3. Similarly (from the above links), send the data to specific indexes, and/or also make only specific individuals, Roles, or Apps can see that data.
One note. Don't change your outputs.conf file in terms of "server = inputs<1-5>.<your domain>.splunkcloud.com", but you can change the destination index.

4. Make sure the index is searchable only by the correct User, Role, and/or App.

See the Related Links Section below.