topic Re: Index cleared after disabling input? in Getting Data In

Index cleared after disabling input?

StefanB — Wed, 16 Feb 2011 20:51:11 GMT

Hello,

when I have configured an input for log files, ie from a certain directory, and I disable it any time, will my index get cleared of this information or is the information still in my index and searchable?

Re: Index cleared after disabling input?

Ayn — Wed, 16 Feb 2011 22:16:08 GMT

All information will still be in the index and searchable.

Re: Index cleared after disabling input?

StefanB — Wed, 16 Feb 2011 22:30:57 GMT

is there any way to clear the index then? or should i better be using different indexes then for every app?

Re: Index cleared after disabling input?

Ayn — Wed, 16 Feb 2011 22:42:48 GMT

You can clean a whole index by issuing "splunk clean -index " from the command line. If you want to remove only specific events you can use the "delete" operator. Note however that events affected by "delete" won't actually disappear from the index, rather they will only be hidden, so they will still take up disk space. Deleted events disappear when they're moved to the frozen bucket, though.