Getting Data In

Removing thawed data

alekksi
Communicator

What is the process of removing thawed data from Splunk?
The documentation doesn't mention it http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Restorearchiveddata
However other threads in answers just suggest stopping the indexer and deleting the data -- is there a CLI way of doing this or is there a way of doing this without stopping my indexer?

0 Karma
1 Solution

somesoni2
Revered Legend

As per the the link above link you shared, Based on my experience, you don't need to restart indexer, just removing the thawed buckets will do.

"You can put archived data in the thawed directory for as long as you need it. When the data is no longer needed, simply delete it or move it out of thawed."

View solution in original post

somesoni2
Revered Legend

As per the the link above link you shared, Based on my experience, you don't need to restart indexer, just removing the thawed buckets will do.

"You can put archived data in the thawed directory for as long as you need it. When the data is no longer needed, simply delete it or move it out of thawed."
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...