Getting Data In

How to delete data from disk without removing searchable portions of the index?

mmccul
SplunkTrust
SplunkTrust

We have a dataset that we hid from the index via a "| delete" command, but we need the data purged from disk as well, without removing the still searchable portions of the index.

Is the data just frozen and we can use the frozen expiration features to remove? Something else?

Any suggestions on how to purge out this old data?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can use Splunk's regular data purging methods, either by size or by age. However, that will remove the oldest buckets first.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can use Splunk's regular data purging methods, either by size or by age. However, that will remove the oldest buckets first.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...