Getting Data In

Splunk Data cleanup

somramsam
Engager

Hi Team!

I would like to clean all the old data from Splunk so that i can limit to 2 years only. Currently it is storing all the data.

How do I achieve it and the steps to do it.

Thank you so much and really apreciated.

 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @somramsam,

do you want to clean all the data or only data older than 2 years?

In the first case you have to launch the CLI command

splunk clean eventdata -index <index_name>

for all indexes, when Splunk is stopped.

If instead you want to clean data older than 2 years, you have to add to all your indexes.conf stanzas the following item

frozenTimePeriodInSecs = 63072000

And then restart Splunk.

Ciao.

Giuseppe

somramsam
Engager

@gcusello : Thank you so much! does this clean and remove the data from splunk or makes the data unsearchable? I really need to save space on the server. Could you please help?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @somramsam,

if you use the delete command (adding to your user the role "can_delete") you make the deleted data unsearchable, but they remain in the buckets.

If instead you use the CLI command or you modify index retention, data will be physically removed.

Remember that if you modify retention, data will be removed as a bucket, in other words you could still have data older than the retention period because they are in a bucket containing some data still in the retention period; the bucket will be removed whan the latest event exceeds the retention period.

For more infos, see at https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Setaretirementandarchivingpolicy

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...