Reduce on disk database size after delete

[kevinzona]

I have run into a situation where a very large amount of data has been imported into the wrong index. This index contains other data as well. My current plan is to run a delete of the incorrectly imported data, create a new index, and reimport. My concern is that a delete does not reduce the actual database size on disk. It seems a clean will remove do what i need, but will also remove the other valid data. Is there anyway, online or offline, to reduce the database size on disk without losing the other data?

I guess I could always run my delete, then dump the remaining contents of the index to a file, remove the index, recreate and reimport. I was just hoping for something easier. Thanks.

[RicoSuave · Accepted solution]

Unfortunately, I don't think there is an "easier" way to do this. I have done the same. Just "delete" the events, output the remaining events by following this post.
Then shutdown splunk and clean the index.
Then re import the events.

[RicoSuave]

I haven't looked into this possibility, but i'm sure this could be scripted somehow. Or maybe an enhancement request should be filed to have some type of a gui to accomplish this.