Getting Data In

Is it possible to manually roll specific buckets to frozen?

tomrit
Explorer

Hi,

is it possible to roll specific buckets to frozen? I have some buckets which the customer wants to be deleted (don't ask why), and I would kindly ask if this is possible without stopping Splunk.

br

Tom

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @tomrit,

for my knowledge the only correct way to delete a bucket is to temporary change the retention period, but in this period you delete all the buckets that exceed the retention period not only some of them.

For more infos about bucket deleting, in Community there are some examples of deleting buckets but I didn't directly tested:

https://community.splunk.com/t5/Deployment-Architecture/How-to-manually-delete-buckets-in-cluster-pe...

https://community.splunk.com/t5/Deployment-Architecture/Delete-corrupt-bucket-or-down-index-in-clust...

If instead you want to delete only a part of a bucket it isn't possible, you can only make a logical deletion (delete command).

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @tomrit,

for my knowledge the only correct way to delete a bucket is to temporary change the retention period, but in this period you delete all the buckets that exceed the retention period not only some of them.

For more infos about bucket deleting, in Community there are some examples of deleting buckets but I didn't directly tested:

https://community.splunk.com/t5/Deployment-Architecture/How-to-manually-delete-buckets-in-cluster-pe...

https://community.splunk.com/t5/Deployment-Architecture/Delete-corrupt-bucket-or-down-index-in-clust...

If instead you want to delete only a part of a bucket it isn't possible, you can only make a logical deletion (delete command).

Ciao.

Giuseppe

tomrit
Explorer

Hi,

 

cool, thanks for the response, the links provide exactly what I need. It seems I'm to dumb to search correctly. 😉

I have to backup these buckets by hand, but that's a no-brainer.

 

Thanks a lot for the fast response!

ciao

Tom

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...