Splunk 7.x Quick Start Guide

Deleting index data

If you want to remove an index and delete the data that is in it, you can remove the index's stanza and entries, and then delete that index's directory from your $SPLUNK_DB location. You can also delete specific events from an index without deleting the index by using Splunk's delete command, which involves creating a search to identify the events you want to get rid of, and piping those search results to the delete command. Note that this action requires that your role (even if you're an admin) include the can_delete capability, and that this activity is dangerous, for obvious reasons. I highly recommend you carefully read the Splunk documentation on this subject before deleting indexes or specific events within an index: ...