Is it possible to manually roll specific buckets to frozen?

[tomrit]

Hi,

is it possible to roll specific buckets to frozen? I have some buckets which the customer wants to be deleted (don't ask why), and I would kindly ask if this is possible without stopping Splunk.

br

Tom

[gcusello · Accepted solution]

Hi @tomrit,

for my knowledge the only correct way to delete a bucket is to temporary change the retention period, but in this period you delete all the buckets that exceed the retention period not only some of them.

For more infos about bucket deleting, in Community there are some examples of deleting buckets but I didn't directly tested:

https://community.splunk.com/t5/Deployment-Architecture/How-to-manually-delete-buckets-in-cluster-pe...

https://community.splunk.com/t5/Deployment-Architecture/Delete-corrupt-bucket-or-down-index-in-clust...

If instead you want to delete only a part of a bucket it isn't possible, you can only make a logical deletion (delete command).

Ciao.

Giuseppe

[tomrit]

Hi,

cool, thanks for the response, the links provide exactly what I need. It seems I'm to dumb to search correctly. 😉

I have to backup these buckets by hand, but that's a no-brainer.

Thanks a lot for the fast response!

ciao

Tom