Deployment Architecture

Is it possible to delete unreferenced buckets while the Splunk server is running?

bbialek
Path Finder

I'm not sure how it came to be, but it looks like my _internal index's cold path has changed. This left a bunch of cold buckets in the old location which seems unreferenced by any index as seen by | dbinspect index=*.

As noted here:
https://answers.splunk.com/answers/108941/deleting-a-bucket.html#answer-108942
hot/warm/cold buckets should not be removed while the server is running, but in this case, it seems it can be done. Can someone confirm?

0 Karma

ddrillic
Ultra Champion

It would be interesting to see what you get when running -

splunk list excess-buckets _internal

Based on Remove excess bucket copies from the indexer cluster

You probably should be just fine to remove them...

0 Karma

bbialek
Path Finder

The command resulted in "In handler 'clustermasterpeerindexes': master is not enabled on this node".

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...