I had a database input which was getting data from a table. I had to clean it up so that i can only get a subset of the columns. So I deleted the records on Splunk by doing
sourcetype="dbmon..." | delete
after doing that i had removed the data i initially imported to splunk. however i see that that _internal index is still showing all those records. i am not sure how to clean up that.
Now my problem is ... when i try to chagne the query on my database input, though i save it ... i am not able to get the data back into splunk. Any help would be appreciated.