How can I purge data older than say 30 days from some but not all of my indexes to free up disk space?

[bgamblin]

I have run out of disk space on my indexers. I need to reclaim space and want to purge data from some of the indexes but save the data in others. How would I do that?

[yannK]

You can edit the indexes.conf on the indexers, and specify a time retention on a per index basis. (frozenTimePeriodInSecs)

[bmacias84]

I would also consider using a combination of maxTotalDataSizeMB, homePath.maxDataSizeMB, and coldPath.maxDataSizeMB to control indice size.

[dflodstrom]

You can adjust the retention of your index and it will start freezing old buckets or you can use the delete command to be more selective:

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Delete