topic Remove Index Command Not Working in Getting Data In

Remove Index Command Not Working

katzr — Tue, 29 Sep 2020 15:22:48 GMT

Hello,

I am looking to remove an index entirely. I ran the search "splunk remove index new_hires" where new_hires is the index name. This command did not remove the index. I have the ability to delete. Why didn't this command work? I am using splunk 6.3.3. I want to remove the entire index and all associated data. Thank you!

Re: Remove Index Command Not Working

ChrisG — Wed, 16 Aug 2017 18:41:23 GMT

The delete command deletes event data from subsequent searches. It does not remove it from disk.

To remove data permanently from an index, use the CLI clean command.

See Remove indexes and indexed data in the Managing Indexers and Clusters of Indexers manual.

Re: Remove Index Command Not Working

kmorris_splunk — Wed, 16 Aug 2017 18:42:12 GMT

Do you have multiple indexers?

Re: Remove Index Command Not Working

lfedak_splunk — Wed, 16 Aug 2017 18:43:30 GMT

Hey @katzr, here's documentation to remove indexes and indexed data. http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/RemovedatafromSplunk#Remove_an_index_entirely It has that CLI command but has a step beforehand directing you make sure no inputs.conf are directing data to the index you plan to delete.

Re: Remove Index Command Not Working

katzr — Wed, 16 Aug 2017 18:45:39 GMT

yes- there are none and I didn't get a warning message that there are any.

Re: Remove Index Command Not Working

katzr — Wed, 16 Aug 2017 18:45:54 GMT

Do I need to clean the data before removing the entire index?

Re: Remove Index Command Not Working

katzr — Wed, 16 Aug 2017 18:47:49 GMT

no I don't believe so- is there anywhere I can check to make sure I don't.

Re: Remove Index Command Not Working

lfedak_splunk — Wed, 16 Aug 2017 18:52:53 GMT

Are you using the [http://docs.splunk.com/Documentation/Splunk/latest/Admin/AbouttheCLI?r=searchtip[ (CLI)? Verifying due to your usage of "ran the search".

Re: Remove Index Command Not Working

kmorris_splunk — Wed, 16 Aug 2017 19:17:04 GMT

I just noticed that you "ran the search" to remove the index. This is actually a command you would need to run via the CLI. Are you the administrator of the Splunk instance? If this is a single server instance (meaning you downloaded from splunk.com and installed it), then you should be able to remove the index from the GUI. However, if it is a distributed environment (meaning a separate search head, and multiple indexers, then the index would need to be removed from each indexer, via command line, using the command you typed in the search bar it seems.

Re: Remove Index Command Not Working

lfedak_splunk — Wed, 16 Aug 2017 19:19:21 GMT

If so, refer to @kmorris's detailed explanation above! 🙂