Getting Data In

Reduce on disk database size after delete

kevinzona
Engager

I have run into a situation where a very large amount of data has been imported into the wrong index. This index contains other data as well. My current plan is to run a delete of the incorrectly imported data, create a new index, and reimport. My concern is that a delete does not reduce the actual database size on disk. It seems a clean will remove do what i need, but will also remove the other valid data. Is there anyway, online or offline, to reduce the database size on disk without losing the other data?

I guess I could always run my delete, then dump the remaining contents of the index to a file, remove the index, recreate and reimport. I was just hoping for something easier. Thanks.

Tags (3)
1 Solution

RicoSuave
Builder

Unfortunately, I don't think there is an "easier" way to do this. I have done the same. Just "delete" the events, output the remaining events by following this post.
Then shutdown splunk and clean the index.
Then re import the events.

View solution in original post

0 Karma

RicoSuave
Builder

Unfortunately, I don't think there is an "easier" way to do this. I have done the same. Just "delete" the events, output the remaining events by following this post.
Then shutdown splunk and clean the index.
Then re import the events.

0 Karma

RicoSuave
Builder

I haven't looked into this possibility, but i'm sure this could be scripted somehow. Or maybe an enhancement request should be filed to have some type of a gui to accomplish this.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...