How do I quickly make some space on the $SPLUNK_DB partition?

[mctester]

The splunk cold storage file system is 100% full. I'm relatively new to splunk & not sure the proper way to purge.

[BunnyHop]

You can easily move buckets either through attaching a script each buckets or make a pointer to the storage of the cold folder/repository on the indexes.conf.

[Mick · Accepted solution]

The easiest way to free up some space is to manually move some directories to an alternate location. If you want to keep the data, make sure you have an archive volume to move it to, if you don't care about the data, you can simply delete it.

As long as you move entire 'buckets' of data you shouldn't run into any trouble. A complete bucket is everything inside a directory with the name format - db_, eg - db_1250709009_1250705372_75

This format tells you the latest event in the bucket (timestamp1), the earliest event (timestamp2), and hence the bucket-span, and finally the ID which was assigned to it on completion. Each bucket ID within an index must be unique. Click here for a more in-depth explanation of how buckets work.

If you want to configure Splunk to manage disk-space itself, then you will want to consider a retirement policy.

[Simeon]

Be aware that you should not move buckets while Splunk is online. If Splunk tries to search data within a bucket, it will throw an error and possibly crash.