Getting Data In

Reduce on disk database size after delete

kevinzona
Engager

I have run into a situation where a very large amount of data has been imported into the wrong index. This index contains other data as well. My current plan is to run a delete of the incorrectly imported data, create a new index, and reimport. My concern is that a delete does not reduce the actual database size on disk. It seems a clean will remove do what i need, but will also remove the other valid data. Is there anyway, online or offline, to reduce the database size on disk without losing the other data?

I guess I could always run my delete, then dump the remaining contents of the index to a file, remove the index, recreate and reimport. I was just hoping for something easier. Thanks.

Tags (3)
1 Solution

RicoSuave
Builder

Unfortunately, I don't think there is an "easier" way to do this. I have done the same. Just "delete" the events, output the remaining events by following this post.
Then shutdown splunk and clean the index.
Then re import the events.

View solution in original post

0 Karma

RicoSuave
Builder

Unfortunately, I don't think there is an "easier" way to do this. I have done the same. Just "delete" the events, output the remaining events by following this post.
Then shutdown splunk and clean the index.
Then re import the events.

0 Karma

RicoSuave
Builder

I haven't looked into this possibility, but i'm sure this could be scripted somehow. Or maybe an enhancement request should be filed to have some type of a gui to accomplish this.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...