topic Re: How do I empty an index in an indexer cluster in Deployment Architecture

How do I empty an index in an indexer cluster

nls7010 — Wed, 22 Jan 2020 19:20:51 GMT

Clients wanted a change in how there data was displayed using the sourcetype they first used. How do I remove all of what they have currently indexed so we don't get duplicate entries?

Re: How do I empty an index in an indexer cluster

Anantha123 — Wed, 22 Jan 2020 20:02:44 GMT

check the below link

https://answers.splunk.com/answers/134553/how-to-delete-data-index-reset-start-from-scratch.html

Hope this helps.

Thanks
Anantha.

Re: How do I empty an index in an indexer cluster

gcusello — Thu, 23 Jan 2020 06:19:23 GMT

HI @nls7010,
in an Indexer Cluster, you could:

set to 1 the Retention Period (frozenTimePeriodInSecs = 1) for your index on Master Node,
push configurations to Peers,
wait 5 minutes,
set the Retention Periodto the value you like (frozenTimePeriodInSecs = your_value) for your index on Master Node,
push configurations to Peers.

Ciao.
Giuseppe