topic Re: How do you delete a default index? in Other Usage

How do you delete a default index?

erikhill — Fri, 12 Jan 2024 01:01:29 GMT

This page states:

You can't delete default indexes and third-party indexes from the Indexes page.

Can I still delete default indexes through the CLI?

Re: How do you delete a default index?

inventsekar — Fri, 12 Jan 2024 02:40:51 GMT

Hi @erikhill

That doc is for "Splunk Cloud"(CLI access is with Splunk Cloud Support Team) and from the GUI page you can not delete.

For Splunk Enterprise, i tried it on my lab setup:

C:\Program Files\Splunk\bin>.\splunk.exe remove index main
WARNING: Server Certificate Warning - ignore this

cannot remove idx=main, is internal

C:\Program Files\Splunk\bin>

so, we can not remove the default index(es), thanks.

Re: How do you delete a default index?

inventsekar — Fri, 12 Jan 2024 13:32:34 GMT

Hi @erikhill may i know if the above reply solves your query, if not, pls let us know more details.

if yes, could you pls accept it as solution, thanks.

Re: How do you delete a default index?

erikhill — Fri, 12 Jan 2024 17:29:07 GMT

I appreciate the response @inventsekar , thank you. I have a main index that I don't need anymore and I'd like to remove. If the index can't be deleted, can all of the data be removed from the index?

Re: How do you delete a default index?

PickleRick — Fri, 12 Jan 2024 17:52:54 GMT

If you already ingested some data into this index and you don't need/want it in your instance anymore you can set a short retention period so that data is quickly rolled out and removed from the index. It's the easiest and most elegant way.

Re: How do you delete a default index?

erikhill — Fri, 12 Jan 2024 17:54:57 GMT

Great! Thanks @PickleRick , I'll give that a shot!