Knowledge Management

Free up space on the index

New Member

I have quite a few hot db and warm in one of my index - sharp. Can I delete the files under the rawdata directory like the journal.gz to clean up some space?

Will that impact the index in any way?

Tags (3)
0 Karma


Um yes, it is definitely going to impact things. The journal is part of how Splunk stores and makes data searchable. If you start deleting this or other files in the index directories Very Bad Things start happening.


To free up space on that index you can set the maximum size for the index to a smaller value. Then Splunk will clean up old stuff without breaking buckets.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!