https://community.splunk.com/t5/Knowledge-Management/Is-it-safe-to-clear-event-data-from-internal/m-p/12757#M6951 <P>Is it safe to clear the _internal index like this? Or should this never be done in the first place? What are the issues that could arise from doing this?</P> <P>$SPLUNK_HOME/bin/splunk clean eventdata -index _internal</P> Mon, 03 May 2010 03:00:04 GMT rayfoo 2010-05-03T03:00:04Z https://community.splunk.com/t5/Knowledge-Management/Is-it-safe-to-clear-event-data-from-internal/m-p/12757#M6951 <P>Is it safe to clear the _internal index like this? Or should this never be done in the first place? What are the issues that could arise from doing this?</P> <P>$SPLUNK_HOME/bin/splunk clean eventdata -index _internal</P> Mon, 03 May 2010 03:00:04 GMT https://community.splunk.com/t5/Knowledge-Management/Is-it-safe-to-clear-event-data-from-internal/m-p/12757#M6951 rayfoo 2010-05-03T03:00:04Z https://community.splunk.com/t5/Knowledge-Management/Is-it-safe-to-clear-event-data-from-internal/m-p/12758#M6952 <P>Yes, it's safe to do. Other than not having the internal logs anymore, it doesn't cause any harm.</P> Mon, 03 May 2010 05:38:15 GMT https://community.splunk.com/t5/Knowledge-Management/Is-it-safe-to-clear-event-data-from-internal/m-p/12758#M6952 gkanapathy 2010-05-03T05:38:15Z https://community.splunk.com/t5/Knowledge-Management/Is-it-safe-to-clear-event-data-from-internal/m-p/12759#M6953 <P>I did this, so what do I need to do if I want it enabled again ? I see the directory for _internal growing but search just isn't seeing it anymore.</P> Tue, 24 Jan 2012 19:31:12 GMT https://community.splunk.com/t5/Knowledge-Management/Is-it-safe-to-clear-event-data-from-internal/m-p/12759#M6953 rsia23 2012-01-24T19:31:12Z