topic Re: how to cleanup splunk space through script in Reporting

how to cleanup splunk space through script

asimsk84 — Wed, 27 Mar 2024 13:47:44 GMT

how to cleanup splunk space through script. I don't have a script. How to create a script to help clean up splunk space and delete old files. not getting reporting; it's not uploading any logs.

Re: how to cleanup splunk space through script

splunkreal — Wed, 27 Mar 2024 14:02:40 GMT

Hello @asimsk84 welcome!

depending on your retention policy on indexes.conf old buckets won't be frozen and will be deleted : https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-define-coldToFrozenDir-in-indexes-conf-to-move-old/m-p/247162

Doc : https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/Indexesconf%20%22coldToFrozenDir%22

You should not delete any file yourself, leave Splunk manage.

Re: how to cleanup splunk space through script

gcusello — Wed, 27 Mar 2024 17:44:36 GMT

Hi @asimsk84 ,

sorry, but why do you want to use a script to clean old Splunk data files?

You can set up a retention time (adding to each index the parameter frozenTimePeriodInSecs) and Splunk automaticall removes the old buckets in a correct way.

Ciao.

Giuseppe