topic Remove Old Summary Index in Knowledge Management

Remove Old Summary Index

clincg — Wed, 04 Aug 2010 04:29:23 GMT

Hi - does anyone know how to remove old summary index data? I have a few summary indexes saved in the system that was running the wrong query and thus indexed the wrong data. Every time I pull the data from that summary index report it will mix the wrong data into the result. We wanted to start over again, is there anyway to delete a particular summary index data or just clear that particular summary index report?

Re: Remove Old Summary Index

hexx — Wed, 04 Aug 2010 05:40:55 GMT

You can delete the contents of the summary index by running :

$SPLUNK_HOME/bin/splunk stop

$SPLUNK_HOME/bin/splunk clean eventdata -index summary

Note that this will completely wipe that index, no events will be kept.

EDIT : The python script $SPLUNK_HOME/bin/fill_summary_index.py can be used to back-fill the summary index.

For more information about the usage of that script, see :

http://www.splunk.com/base/Documentation/4.1.4/Knowledge/Managesummaryindexgapsandoverlaps#Use_the_backfill_script_to_add_other_data_or_fill_summary_index_gaps

Re: Remove Old Summary Index

ftk — Wed, 04 Aug 2010 19:21:19 GMT

You should be able to keep the incorrect data from showing up with | delete. Come up with a search that only shows the bad data as a result, and then pipe it to delete. Note that this will not actually delete the data out of the index, but prevent it from showing up in future searches.

More info: http://www.splunk.com/base/Documentation/latest/Admin/RemovedatafromSplunk

Re: Remove Old Summary Index

gkanapathy — Thu, 05 Aug 2010 01:09:16 GMT

Backfilling does not require much work (in 4.x and up). Splunk comes with a backfill script that can backfill any summary index (or set of them) over any period with a single command line.

Re: Remove Old Summary Index

hexx — Thu, 05 Aug 2010 04:39:06 GMT

I stand corrected, then. Thanks, G!

Re: Remove Old Summary Index

clincg — Thu, 05 Aug 2010 05:19:35 GMT

Thanks, the " | delete" actually works. Never thought of the "delete" command works for the summary index data as well.