https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180490#M36210 <P>There is a complete topic on this in the documentation: <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/Indexer/RemovedatafromSplunk">Remove indexes and indexed data</A>. It explains the four main options:</P> <UL> <LI>Delete events from subsequent searches.</LI> <LI>Remove all data from one or more indexes.</LI> <LI>Remove or disable an entire index.</LI> <LI>Delete older data, based on a retirement policy.</LI> </UL> Wed, 22 Oct 2014 20:32:55 GMT ChrisG 2014-10-22T20:32:55Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180488#M36208 <P>Hi There,</P> <P>We have an index which is approx. 250GB in size. After change in requirements we no longer require approx. half of the data. I would like to delete approx. half of the indexed data and free up the disk space in the file system. How would I go about achieving this?</P> <P>Thanks</P> Wed, 22 Oct 2014 09:51:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180488#M36208 mahesh_ravji1 2014-10-22T09:51:53Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180489#M36209 <P>Hopefully some of your older data is in separate warm or cold buckets from data you want to keep, look in your db directory for the index and then read this document:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/Indexer/HowSplunkstoresindexes">http://docs.splunk.com/Documentation/Splunk/6.1.4/Indexer/HowSplunkstoresindexes</A></P> <P>Then assuming your config is set to roll to warm and cold frequently enough (which you will know by finding or not finding appropriately named buckets), identify old bucket directories and remove them from the filesystem. </P> Wed, 22 Oct 2014 20:29:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180489#M36209 chanfoli 2014-10-22T20:29:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180490#M36210 <P>There is a complete topic on this in the documentation: <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/Indexer/RemovedatafromSplunk">Remove indexes and indexed data</A>. It explains the four main options:</P> <UL> <LI>Delete events from subsequent searches.</LI> <LI>Remove all data from one or more indexes.</LI> <LI>Remove or disable an entire index.</LI> <LI>Delete older data, based on a retirement policy.</LI> </UL> Wed, 22 Oct 2014 20:32:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180490#M36210 ChrisG 2014-10-22T20:32:55Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180491#M36211 <P>This of course is assuming that the data you want to keep is newer that the data you no longer need. If they are mixed together in the same index and the value to you is not time based, then you can either reindex the data you want from original source into a new index, or look into the collect command if you don't have the original sources, as you will need to search for the data you want to keep and collect it into a new index, so you can clean or drop the index containing the data you do not want.</P> Wed, 22 Oct 2014 20:34:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180491#M36211 chanfoli 2014-10-22T20:34:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180492#M36212 <P>Unfortunately none of these options suit our needs. Also cannot use the retirement policy as the data to be deleted spans ‘All Time’.</P> Mon, 27 Oct 2014 11:27:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180492#M36212 mahesh_ravji1 2014-10-27T11:27:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180493#M36213 <P>Unfortunately the data to be deleted spans 'All Time'. I'll look into the collect command...</P> Mon, 27 Oct 2014 11:33:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-some-indexed-data-and-free-up-disk-space/m-p/180493#M36213 mahesh_ravji1 2014-10-27T11:33:59Z