- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it possible to delete unreferenced buckets while the Splunk server is running?
bbialek
Path Finder
07-19-2016
08:16 AM
I'm not sure how it came to be, but it looks like my _internal index's cold path has changed. This left a bunch of cold buckets in the old location which seems unreferenced by any index as seen by | dbinspect index=*
.
As noted here:
https://answers.splunk.com/answers/108941/deleting-a-bucket.html#answer-108942
hot/warm/cold buckets should not be removed while the server is running, but in this case, it seems it can be done. Can someone confirm?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ddrillic
Ultra Champion
07-19-2016
12:19 PM
It would be interesting to see what you get when running -
splunk list excess-buckets _internal
Based on Remove excess bucket copies from the indexer cluster
You probably should be just fine to remove them...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bbialek
Path Finder
07-19-2016
12:29 PM
The command resulted in "In handler 'clustermasterpeerindexes': master is not enabled on this node".
