Getting Data In

Is it possible to manually roll specific buckets to frozen?

tomrit
Explorer

Hi,

is it possible to roll specific buckets to frozen? I have some buckets which the customer wants to be deleted (don't ask why), and I would kindly ask if this is possible without stopping Splunk.

br

Tom

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @tomrit,

for my knowledge the only correct way to delete a bucket is to temporary change the retention period, but in this period you delete all the buckets that exceed the retention period not only some of them.

For more infos about bucket deleting, in Community there are some examples of deleting buckets but I didn't directly tested:

https://community.splunk.com/t5/Deployment-Architecture/How-to-manually-delete-buckets-in-cluster-pe...

https://community.splunk.com/t5/Deployment-Architecture/Delete-corrupt-bucket-or-down-index-in-clust...

If instead you want to delete only a part of a bucket it isn't possible, you can only make a logical deletion (delete command).

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @tomrit,

for my knowledge the only correct way to delete a bucket is to temporary change the retention period, but in this period you delete all the buckets that exceed the retention period not only some of them.

For more infos about bucket deleting, in Community there are some examples of deleting buckets but I didn't directly tested:

https://community.splunk.com/t5/Deployment-Architecture/How-to-manually-delete-buckets-in-cluster-pe...

https://community.splunk.com/t5/Deployment-Architecture/Delete-corrupt-bucket-or-down-index-in-clust...

If instead you want to delete only a part of a bucket it isn't possible, you can only make a logical deletion (delete command).

Ciao.

Giuseppe

tomrit
Explorer

Hi,

 

cool, thanks for the response, the links provide exactly what I need. It seems I'm to dumb to search correctly. 😉

I have to backup these buckets by hand, but that's a no-brainer.

 

Thanks a lot for the fast response!

ciao

Tom

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...