Getting Data In

Remove Index Command Not Working

katzr
Path Finder

Hello,

I am looking to remove an index entirely. I ran the search "splunk remove index new_hires" where new_hires is the index name. This command did not remove the index. I have the ability to delete. Why didn't this command work? I am using splunk 6.3.3. I want to remove the entire index and all associated data. Thank you!

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @katzr, here's documentation to remove indexes and indexed data. http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/RemovedatafromSplunk#Remove_an_index_entir... It has that CLI command but has a step beforehand directing you make sure no inputs.conf are directing data to the index you plan to delete.

0 Karma

katzr
Path Finder

yes- there are none and I didn't get a warning message that there are any.

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Are you using the [http://docs.splunk.com/Documentation/Splunk/latest/Admin/AbouttheCLI?r=searchtip[ (CLI)? Verifying due to your usage of "ran the search".

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

If so, refer to @kmorris's detailed explanation above! 🙂

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Do you have multiple indexers?

kmorris_splunk
Splunk Employee
Splunk Employee

I just noticed that you "ran the search" to remove the index. This is actually a command you would need to run via the CLI. Are you the administrator of the Splunk instance? If this is a single server instance (meaning you downloaded from splunk.com and installed it), then you should be able to remove the index from the GUI. However, if it is a distributed environment (meaning a separate search head, and multiple indexers, then the index would need to be removed from each indexer, via command line, using the command you typed in the search bar it seems.

katzr
Path Finder

no I don't believe so- is there anywhere I can check to make sure I don't.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

The delete command deletes event data from subsequent searches. It does not remove it from disk.

To remove data permanently from an index, use the CLI clean command.

See Remove indexes and indexed data in the Managing Indexers and Clusters of Indexers manual.

katzr
Path Finder

Do I need to clean the data before removing the entire index?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...