topic Re: Deleting data from summary index or any index? in Getting Data In

Deleting data from summary index or any index?

asingla — Wed, 07 Dec 2011 20:01:14 GMT

I am summarizing my data every minute but I do not need that data after one hour. So I have schedule another search to run every hour to delete this old data. But I am realizing it is not freeing up the disk space. Am I missing anything? Do I need to do something more than just calling the | delete command?

Re: Deleting data from summary index or any index?

RicoSuave — Wed, 07 Dec 2011 20:04:13 GMT

Please look at the answer posted here.

http://splunk-base.splunk.com/answers/1484/how-do-i-delete-events

Deleting events does not reclaim disk space.

Re: Deleting data from summary index or any index?

Damien_Dallimor — Wed, 07 Dec 2011 20:57:46 GMT

The delete search command is only a "soft" delete ie: marks events as being deleted.
To do a hard delete, you need to delete the index or roll it off to frozen bucket with an aggressive frequency.