https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290735#M11014 <P>It's more of a data cleanup issue. I was trying to avoid having to re-index a large chunk of data.</P> <P>Thanks.</P> Tue, 27 Mar 2018 11:26:31 GMT caseyra 2018-03-27T11:26:31Z https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290729#M11008 <P>Just what the title says. If I delete a bunch of data from an index and some of the buckets are now effectively empty (E.g. all of them have been marked as deleted), what happens to the bucket? Is it removed or will it stick around until it is frozen?</P> Mon, 26 Mar 2018 18:07:07 GMT https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290729#M11008 caseyra 2018-03-26T18:07:07Z https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290730#M11009 <P>It depends what you did to delete the data: did you use the <CODE>delete</CODE> command (which does not actually remove anything from disk), or <CODE>clean</CODE>, or <CODE>remove index</CODE>? </P> <P>If you have not already done so, I highly encourage you to read <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/RemovedatafromSplunk">Remove indexes and indexed data</A> in the Splunk Enterprise documentation.</P> Mon, 26 Mar 2018 18:29:26 GMT https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290730#M11009 ChrisG 2018-03-26T18:29:26Z https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290731#M11010 <P>It will stick around until the bucket is frozen. The bucket mover uses the epoch times in the bucket (directory) name and doesn't really inspect the contents of the bucket to determine whether it can be frozen or not. </P> Mon, 26 Mar 2018 18:30:11 GMT https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290731#M11010 s2_splunk 2018-03-26T18:30:11Z https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290732#M11011 <P>Just delete. I'm not trying to remove the entire index. I just wanted to know what would happen from a disk space perspective.</P> Mon, 26 Mar 2018 18:47:57 GMT https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290732#M11011 caseyra 2018-03-26T18:47:57Z https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290733#M11012 <P>O.K. So, is there a way to determine if a bucket has only deleted entries? And, if so, can we force the bucket to be rolled to frozen? Or, is the file basically stuck there until it is frozen?</P> Mon, 26 Mar 2018 18:49:30 GMT https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290733#M11012 caseyra 2018-03-26T18:49:30Z https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290734#M11013 <P>The short answer is no, buckets will honor the configured retention policy settings and there is no way to force a freeze unless you are (temporarily) reducing the index configuration. I am not aware of any way to safely determine whether a given bucket contains only deleted events. <BR /> The only way currently to physically delete events (buckets, really), is to run <EM>clean eventdata</EM>, which will wipe everything for the given index, so you'll have to come up with a plan to export/collect any events you do not want to delete.</P> <P>What's your use case? Compliance? New EU regulations?</P> Mon, 26 Mar 2018 19:25:29 GMT https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290734#M11013 s2_splunk 2018-03-26T19:25:29Z https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290735#M11014 <P>It's more of a data cleanup issue. I was trying to avoid having to re-index a large chunk of data.</P> <P>Thanks.</P> Tue, 27 Mar 2018 11:26:31 GMT https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290735#M11014 caseyra 2018-03-27T11:26:31Z https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290736#M11015 <P>Follow-up question: I did a little digging with dbinspect and noticed that some buckets can have an eventCount of zero, but the rawSize and/or sizeOnDiskMB is non-zero. This seems to indicate that these buckets have had all their records deleted, but are still taking up space on the system. Is that correct?</P> Fri, 06 Apr 2018 14:15:03 GMT https://community.splunk.com/t5/Deployment-Architecture/What-happens-to-a-bucket-if-all-of-the-data-within-it-is-deleted/m-p/290736#M11015 caseyra 2018-04-06T14:15:03Z