Getting Data In

Removing thawed data

alekksi
Communicator

What is the process of removing thawed data from Splunk?
The documentation doesn't mention it http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Restorearchiveddata
However other threads in answers just suggest stopping the indexer and deleting the data -- is there a CLI way of doing this or is there a way of doing this without stopping my indexer?

0 Karma
1 Solution

somesoni2
Revered Legend

As per the the link above link you shared, Based on my experience, you don't need to restart indexer, just removing the thawed buckets will do.

"You can put archived data in the thawed directory for as long as you need it. When the data is no longer needed, simply delete it or move it out of thawed."

View solution in original post

somesoni2
Revered Legend

As per the the link above link you shared, Based on my experience, you don't need to restart indexer, just removing the thawed buckets will do.

"You can put archived data in the thawed directory for as long as you need it. When the data is no longer needed, simply delete it or move it out of thawed."
Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...