Knowledge Management

Is it safe to clear event data from _internal?

rayfoo
Path Finder

Is it safe to clear the _internal index like this? Or should this never be done in the first place? What are the issues that could arise from doing this?

$SPLUNK_HOME/bin/splunk clean eventdata -index _internal

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes, it's safe to do. Other than not having the internal logs anymore, it doesn't cause any harm.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Yes, it's safe to do. Other than not having the internal logs anymore, it doesn't cause any harm.

rsia23
Explorer

I did this, so what do I need to do if I want it enabled again ? I see the directory for _internal growing but search just isn't seeing it anymore.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...