Getting Data In
Highlighted

Index cleared after disabling input?

Explorer

Hello,

when I have configured an input for log files, ie from a certain directory, and I disable it any time, will my index get cleared of this information or is the information still in my index and searchable?

Tags (2)
0 Karma
Highlighted

Re: Index cleared after disabling input?

Legend

All information will still be in the index and searchable.

View solution in original post

Highlighted

Re: Index cleared after disabling input?

Explorer

is there any way to clear the index then? or should i better be using different indexes then for every app?

0 Karma
Highlighted

Re: Index cleared after disabling input?

Legend

You can clean a whole index by issuing "splunk clean -index " from the command line. If you want to remove only specific events you can use the "delete" operator. Note however that events affected by "delete" won't actually disappear from the index, rather they will only be hidden, so they will still take up disk space. Deleted events disappear when they're moved to the frozen bucket, though.

0 Karma