Delete Command in Splunk - A Common Misconception

Applicability

Splunk Enterprise Splunk Cloud

Description

Users may encounter confusion when using the "| delete" command in Splunk. While they may expect it to free up storage space by physically removing data, it actually only marks data as deleted without reclaiming disk space.

This article applies to all Splunk Enterprise installations, particularly beneficial to administrators looking to free up disk space.

Investigation

1. Review the user's role and permissions, ensuring they have "can_delete" capabilities.
2. Confirm the behavior by running a search and applying the "| delete" command. The search returns events but shows 0 events deleted.
3. Confirm that this happens with any index defined.

Resolution

The "| delete" command is not designed to free up disk space. It only marks events as deleted so they do not appear in future searches. To physically remove data from an index and free up disk space, use the 'clean' command. Note that the 'clean' command removes all data from a specific index. It cannot selectively delete specific data.

Run the command as follows:

splunk clean eventdata -index <index_name>

Refer to the following documentation for more details: Remove data from Splunk

Related Links

Remove data from Splunk

Revision History

Revision	Publish Date	Comments
1.0	30-Sep-2026	Initial Release