topic Re: python sdk clean index does not seem to work in Splunk Dev

python sdk clean index does not seem to work

sathiyamoorthy — Mon, 17 Mar 2014 18:15:02 GMT

Logged in as admin, and executing clean method on an index does not seem to work:

tt.indexes['test_index'].clean()

Logged in to splunk web and able to see data which has been indexed before the clean() is executed.

Should I do anything else to actually clean the index?

Using splunk 6 and splunk-sdk 1.0. I couldn't find any relevant change in the splunk-sdk 1.2. Thanks.

Re: python sdk clean index does not seem to work

gblock_splunk — Tue, 18 Mar 2014 00:40:51 GMT

Hi @sathiyamoorthy

Sorry you are having issues. Do you get any errors or output?

What OS platform are you running this on?

Thanks!

Re: python sdk clean index does not seem to work

sathiyamoorthy — Tue, 18 Mar 2014 09:35:36 GMT

There is no error / output. OS is redhat.

Re: python sdk clean index does not seem to work

gblock_splunk — Tue, 18 Mar 2014 18:17:29 GMT

Hi @sathiamoorthy

We’ve done some investigation into this API and it has inconsistent results. Our recommendation is to not rely on it. We are evaluating whether or not we will keep it in future versions of the SDK.

Can you elaborate more on exactly what your use case is for this?

Are you using this during development, or in a production environment?
Is the Splunk instance running locally or on a remote machine.

Thanks
Glenn

Re: python sdk clean index does not seem to work

sathiyamoorthy — Wed, 19 Mar 2014 18:05:33 GMT

Using this in development, executing the following external command from python script which works for now.

splunk clean eventdata -index INDEXNAME -f

Will soon be using "| delete" to delete specific data of that index rather than deleting everything.

Thanks for the recommendation I will not use the SDK method to clean summary index.

Re: python sdk clean index does not seem to work

gblock_splunk — Wed, 19 Mar 2014 18:08:39 GMT

Hi @sathiyamoorthy

Thanks for clarifying. If you are using in development, then calling the splunk CLI was going to be my recommendation. The CLI is not using the same path as the API, it actually directly talks to the Splunk instance.

Sorry for any inconvenience this has caused you.

Thanks
Glenn

Re: python sdk clean index does not seem to work

gblock_splunk — Wed, 19 Mar 2014 22:21:05 GMT

@sathiyamoorthy, one other option to consider is to delete and re-created indexes using the SDK rather than clean. We do this on our internal tests and it works.