Deleting data from summary index or any index?

[asingla]

I am summarizing my data every minute but I do not need that data after one hour. So I have schedule another search to run every hour to delete this old data. But I am realizing it is not freeing up the disk space. Am I missing anything? Do I need to do something more than just calling the | delete command?

[Damien_Dallimor · Accepted solution]

The delete search command is only a "soft" delete ie: marks events as being deleted.
To do a hard delete, you need to delete the index or roll it off to frozen bucket with an aggressive frequency.

[RicoSuave]

Please look at the answer posted here.

http://splunk-base.splunk.com/answers/1484/how-do-i-delete-events

Deleting events does not reclaim disk space.