Getting Data In

Removing thawed data

alekksi
Communicator

What is the process of removing thawed data from Splunk?
The documentation doesn't mention it http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Restorearchiveddata
However other threads in answers just suggest stopping the indexer and deleting the data -- is there a CLI way of doing this or is there a way of doing this without stopping my indexer?

0 Karma
1 Solution

somesoni2
Revered Legend

As per the the link above link you shared, Based on my experience, you don't need to restart indexer, just removing the thawed buckets will do.

"You can put archived data in the thawed directory for as long as you need it. When the data is no longer needed, simply delete it or move it out of thawed."

View solution in original post

somesoni2
Revered Legend

As per the the link above link you shared, Based on my experience, you don't need to restart indexer, just removing the thawed buckets will do.

"You can put archived data in the thawed directory for as long as you need it. When the data is no longer needed, simply delete it or move it out of thawed."
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...