Getting Data In

How do I delete an index?

akawacz
Path Finder

Hi

I would like to delete an index. This will be my first time, so I do not want to do to much harm.

-Is there any obstacle?
-What is the best way to do that?
-About what I need to remember?

or maybe I could remove data if I do not have any extracted fields?

Thank you

0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust

In summary:

First you'll want to ensure that any inputs that are sending events to that index are disabled. This way the indexer won't be confused while it keeps receiving events for a deleted index.

Next, delete or comment out any configuration in indexes.conf associated with this index.

Finally, restart the indexer ( or apply cluster-bundle for indexer cluster ) and then delete the directory the index is associated with.

More details here : http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/RemovedatafromSplunk

View solution in original post

akawacz
Path Finder

link is very useful. Thank you.

Last question:

if I go to Settings - Inexes. There I see Actions "DELETE" available next to indexes which have been created. This has not been mentioned on documentation

Can I use it ? What is the drowback of that way?

0 Karma

muebel
SplunkTrust
SplunkTrust

In summary:

First you'll want to ensure that any inputs that are sending events to that index are disabled. This way the indexer won't be confused while it keeps receiving events for a deleted index.

Next, delete or comment out any configuration in indexes.conf associated with this index.

Finally, restart the indexer ( or apply cluster-bundle for indexer cluster ) and then delete the directory the index is associated with.

More details here : http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/RemovedatafromSplunk

akawacz
Path Finder

link is very useful. Thank you.

Last question:
Currently I have just flat files.
if I go to Settings - Inexes. There I see Actions "DELETE" available next to indexes which have been created. This has not been mentioned on documentation

Can I use it ? What is the drowback of that way?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...