topic Re: Reduce on disk database size after delete in Getting Data In

Reduce on disk database size after delete

kevinzona — Wed, 01 Feb 2012 13:43:36 GMT

I have run into a situation where a very large amount of data has been imported into the wrong index. This index contains other data as well. My current plan is to run a delete of the incorrectly imported data, create a new index, and reimport. My concern is that a delete does not reduce the actual database size on disk. It seems a clean will remove do what i need, but will also remove the other valid data. Is there anyway, online or offline, to reduce the database size on disk without losing the other data?

I guess I could always run my delete, then dump the remaining contents of the index to a file, remove the index, recreate and reimport. I was just hoping for something easier. Thanks.

Re: Reduce on disk database size after delete

RicoSuave — Wed, 01 Feb 2012 15:58:52 GMT

Unfortunately, I don't think there is an "easier" way to do this. I have done the same. Just "delete" the events, output the remaining events by following this post.
Then shutdown splunk and clean the index.
Then re import the events.

Re: Reduce on disk database size after delete

RicoSuave — Wed, 01 Feb 2012 16:27:12 GMT

I haven't looked into this possibility, but i'm sure this could be scripted somehow. Or maybe an enhancement request should be filed to have some type of a gui to accomplish this.