Getting Data In

How can I purge data older than say 30 days from some but not all of my indexes to free up disk space?

Explorer

I have run out of disk space on my indexers. I need to reclaim space and want to purge data from some of the indexes but save the data in others. How would I do that?

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

You can edit the indexes.conf on the indexers, and specify a time retention on a per index basis. (frozenTimePeriodInSecs)

Champion

I would also consider using a combination of maxTotalDataSizeMB, homePath.maxDataSizeMB, and coldPath.maxDataSizeMB to control indice size.

0 Karma

Builder

You can adjust the retention of your index and it will start freezing old buckets or you can use the delete command to be more selective:

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Delete
0 Karma