Disable an index or Stopping the indexer to clean eventdata?

[michael_lee]

hi,

In the documents, it's stated before we clean eventdata, we should stop the indexer. But if I don't want to do that, can just disabling the index and then cleaning it suffice?
thanks

[stephanefotso · Accepted solution]

No! you have to stop the indexer before clean eventdata. In other words, you have stop splunkd .By simply disabling the indexer,you could not be able to clean eventdata in your index .

Thanks!