How to Delete Splunk Data Manually, Edit Retention Policy and Splunk Delete Command Functionality

Applicability

Splunk Enterprise 9.1.0

Description

If there is any confusion on how the Delete command works before providing any suggestions please refer to the following paragraph:

"Permanently removing data from an index
The delete command does not remove the data from your disk space. You must use the clean command from the CLI to permanently remove the data. The clean command removes all of the data in an index. You cannot select the specific data that you want to remove. See Remove indexes and indexed data (http://docs.splunk.com/Documentation/Splunk/9.1.0/Indexer/RemovedatafromSplunk) in Managing Indexers and Clusters of Indexers."

The information is available on this link: Delete
 

Investigation

• When executing the "| delete" command in the search query, it effectively marks those events in specific buckets for deletion (but it does not permanently deleted them immediately). But the delete would effectively make them non-searchable in Splunk (if that is the goal). However, the "| delete" command is only masking the data until it is automatically purged by the maxTotalDataSizeMB and frozenTimePeriodInSecs attributes in indexes.conf when these settings are met.

Resolution

• To delete EVERYTHING in an index, it is needed to use the clean command from the command line.

  splunk clean eventdata -index <indexname>

  See Remove indexed data from Splunk (RemovedatafromSplunk) for more detail.

 

• To delete specific events, it is needed to add the "can_delete" roll to the account, search for the data to delete, and then pipe to the delete command. For example from the search bar of your browser to delete <mydata> older than a year:

  index=main sourcetype=<mydata> latest=-1y | delete

  See Delete command (Delete) for more detail.
• In case the "| delete" command does not work, there are two way to effectively remove the bucket permanently which would be manual deletion from disk. 

First, you may use dbinspect to identify the indexer hosts and the corresponding bucket paths containing the event data, you can execute the following sample query:

| dbinspect index=logs splunk_server=indexer

1. After identifying the buckets, locate the paths for the hot/warm/cold buckets for that particular index.
For example: 

$ ls -l /d/d1/splunk/prod/index_name/10/db/logs/db
total 124  
-rw-r--r-- 1 psplunk cc2283 10 Aug 2 21:02 CreationTime
drwxr-xr-x 2 psplunk cc2283 4096 Aug 2 21:02 GlobalMetaData
drwxr-xr-x 3 psplunk cc2283 20480 Dec 11 12:48 db_1701824008_1701388768_76
-rw-r--r-- 1 psplunk cc2283 0 Dec 11 12:48 db_1701824008_1701388768_76.rbsentinel 
drwxr-xr-x 3 psplunk cc2283 4096 Dec 12 14:29 hot_v1_82
drwxr-xr-x 3 psplunk cc2283 4096 Dec 12 14:29 hot_v1_83$ ls -l /d/d1/splunk/prod/index_name/10/db/logs/colddb
total 292
drwxr-xr-x 3 psplunk cc2283 4096 Nov 12 01:42 db_1699830546_1699795309_59 
-rw-r--r-- 1 psplunk cc2283 0 Dec 7 15:15 db_1700309006_1699860554_63.rbsentinel 

In this example, you would manually delete the desired directories: 

/d/d1/splunk/prod/index_name/10/db/logs/db
/d/d1/splunk/prod/index_name/10/db/logs/colddb

This will performantly remove them from disk immediately and upon running the search for these events, the data will not be found as expected, within Splunk UI.

 

2. The other recommendation is to execute the same search and delete command within the command line versus doing it in the GUI (if you encounter any problem on the web interface). 

 

You may reference this Splunk doc when looking for search and delete syntax to be use via CLI

IF there are many buckets where data needs to be purged from disk, you may want to write a recursive SED command to iterative run the removal on the affected indexers to get rid of the bucket data more seamlessly.

The ramification is that you will likely delete all data in those same bucket as the intended data you wish to remove from the "| delete" command, since it would be deleted directly from disk, it's everything in that bucket vs having the specific events searched for in the Splunk store.

• To automatically delete data in an index older than age, it is needed to set the frozenTimePeriodInSecs attribute in indexes.conf. E.g. to set the default to delete data after 1-year use:

[default]
frozenTimePeriodInSecs = 31536000

• To automatically delete data in an index based on bucket size, it is needed to set the maxTotalDataSizeMB attribute in indexes.conf. E.g. to set the default to delete data after exceeding 500 GB use.

[default]
maxTotalDataSizeMB = 500000

• See Set a retirement and archiving policy and the Indexes.conf spec doc for more details.

Related Links

Remove data from Splunk

Delete

Set a retirement and archiving policy

Indexes.conf spec doc

search and delete syntax to be use via CLI

Revision History

Revision	Publish Date	Comments
1.0	30-Sep-2026	Initial Release