Getting Data In
Highlighted

Is it safe to delete manually frozen buckets while indexer cluster is up and running?

Explorer

Is it safe to delete all frozen buckets from coldToFrozenDir manually from the indexers, while the cluster is up and running?
We have one big ColdToFrozenDir, to which all frozen buckets are copied from all indexes. Since this is called an archive, I would expect that splunk doesn't care when I delete them. Is this true?

Thanks!

0 Karma
Highlighted

Re: Is it safe to delete manually frozen buckets while indexer cluster is up and running?

Splunk Employee
Splunk Employee

You can do whatever you wish in the archive directory. Once data is frozen, it is 100% outside of Splunk's management and control.