topic What are different ways of clearing an index automatically on the last day of the month? in Getting Data In

What are different ways of clearing an index automatically on the last day of the month?

athorat — Wed, 12 Aug 2015 17:56:28 GMT

We want to clear the index on the last day of the month and load the index with new data on the first of every month.
What would be different ways to clear the index automatically on the last day of the month?

Re: What are different ways of clearing an index automatically on the last day of the month?

somesoni2 — Wed, 12 Aug 2015 18:44:50 GMT

Below link from the Splunk document describes various ways a data for index can be removed.

http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/RemovedatafromSplunk#Remove_data_from_one_or_all_indexes.

The best one is "clean" command from Splunk CLI as it can be automated. Note that it doesn't work in clustered environment.

For scheduling to last day of month, there is no direct cron available in SPlunk to do that but you can run a search daily, check if the current date is last day of month, if yes then as an alert action run your script for cleanup indexed data.

Re: What are different ways of clearing an index automatically on the last day of the month?

athorat — Wed, 12 Aug 2015 19:08:18 GMT

We have a 3 node index cluster in prod and this will eventually be moved to prod.
by creating a report with delete option and scheduling the job to run on the last day, will that work in a cluster?

Re: What are different ways of clearing an index automatically on the last day of the month?

woodcock — Wed, 12 Aug 2015 23:31:18 GMT

If you have a 3 node index cluster in prod and you create a report that ends with the delete option and schedule the job to run on the last day, it will definitely delete all copies of the data and it will not appear in any search results after that.