Removing data by using delete command in Splunk SPL Query

Applicability

Description

Removing data from Splunk is possible by appending the delete command to the SPL search.

Investigation

 Pre-requisites:

Users do not have access to delete the data by default. Even the admin user/role cannot delete data and only users which have the "can_delete" capability will have the ability to delete events.  Without this capability enabled, the events will not be removed and only hidden from future searches.

The delete command can be accessed only by a user with the "delete_by_keyword" capability.

Also note that the delete command does not work with streaming commands like head, stats, streamstats, and some modes of dedup.

Resolution

1. First, identify the list of events to be removed. It is done using a normal search query specifying the filter condition. 

Example given below :- 

index=web_app status=505

2. Next, append the delete command to remove the above selected data from the result.

index=_web_app status=505
| delete

3. After running the search query above, the events will be deleted. 

Note: Removal of data is irreversible. If the end user wants the removed data back into Splunk then, the process would be to have the original source data copy which can be used to re-index the data in Splunk. It will be a process similar to creating a new index. 

The delete command does not remove the data from the disk space. The clean command from the CLI is used to permanently remove the data. The clean command removes all of the data in an index and cannot select the specific data to be removed.  Reference: Remove indexes and indexed data | Splunk Enterprise 

For Splunk Cloud, the clean command cannot be used. The delete command is the only option for removing data from the search results.

Related Links

delete | Splunk Enterprise, Splunk Cloud Platform

Remove indexes and indexed data | Splunk Enterprise