topic Splunk Data cleanup in Getting Data In

Splunk Data cleanup

somramsam — Mon, 24 May 2021 12:30:26 GMT

Hi Team!

I would like to clean all the old data from Splunk so that i can limit to 2 years only. Currently it is storing all the data.

How do I achieve it and the steps to do it.

Thank you so much and really apreciated.

Re: Splunk Data cleanup

gcusello — Mon, 24 May 2021 13:09:14 GMT

Hi @somramsam,

do you want to clean all the data or only data older than 2 years?

In the first case you have to launch the CLI command

splunk clean eventdata -index <index_name>

for all indexes, when Splunk is stopped.

If instead you want to clean data older than 2 years, you have to add to all your indexes.conf stanzas the following item

frozenTimePeriodInSecs = 63072000

And then restart Splunk.

Ciao.

Giuseppe

Re: Splunk Data cleanup

somramsam — Mon, 14 Jun 2021 21:24:04 GMT

@gcusello : Thank you so much! does this clean and remove the data from splunk or makes the data unsearchable? I really need to save space on the server. Could you please help?

Re: Splunk Data cleanup

gcusello — Tue, 15 Jun 2021 07:07:07 GMT

Hi @somramsam,

if you use the delete command (adding to your user the role "can_delete") you make the deleted data unsearchable, but they remain in the buckets.

If instead you use the CLI command or you modify index retention, data will be physically removed.

Remember that if you modify retention, data will be removed as a bucket, in other words you could still have data older than the retention period because they are in a bucket containing some data still in the retention period; the bucket will be removed whan the latest event exceeds the retention period.

For more infos, see at https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Setaretirementandarchivingpolicy

Ciao.

Giuseppe