Splunk Data cleanup

[somramsam]

Hi Team!

I would like to clean all the old data from Splunk so that i can limit to 2 years only. Currently it is storing all the data.

How do I achieve it and the steps to do it.

Thank you so much and really apreciated.

[gcusello]

Hi @somramsam,

do you want to clean all the data or only data older than 2 years?

In the first case you have to launch the CLI command

splunk clean eventdata -index <index_name>

for all indexes, when Splunk is stopped.

If instead you want to clean data older than 2 years, you have to add to all your indexes.conf stanzas the following item

frozenTimePeriodInSecs = 63072000

And then restart Splunk.

Ciao.

Giuseppe

[somramsam]

@gcusello : Thank you so much! does this clean and remove the data from splunk or makes the data unsearchable? I really need to save space on the server. Could you please help?

[gcusello]

Hi @somramsam,

if you use the delete command (adding to your user the role "can_delete") you make the deleted data unsearchable, but they remain in the buckets.

If instead you use the CLI command or you modify index retention, data will be physically removed.

Remember that if you modify retention, data will be removed as a bucket, in other words you could still have data older than the retention period because they are in a bucket containing some data still in the retention period; the bucket will be removed whan the latest event exceeds the retention period.

For more infos, see at https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Setaretirementandarchivingpolicy

Ciao.

Giuseppe