In the documents, it's stated before we clean eventdata, we should stop the indexer. But if I don't want to do that, can just disabling the index and then cleaning it suffice?
thanks
No! you have to stop the indexer before clean eventdata. In other words, you have stop splunkd .By simply disabling the indexer,you could not be able to clean eventdata in your index .
No! you have to stop the indexer before clean eventdata. In other words, you have stop splunkd .By simply disabling the indexer,you could not be able to clean eventdata in your index .
