How do you delete a default index?

[erikhill]

This page states: 

You can't delete default indexes and third-party indexes from the Indexes page. 

Can I still delete default indexes through the CLI?

[inventsekar · Accepted solution]

Hi @erikhill 

That doc is for "Splunk Cloud"(CLI access is with Splunk Cloud Support Team) and from the GUI page you can not delete.

For Splunk Enterprise, i tried it on my lab setup:

C:\Program Files\Splunk\bin>.\splunk.exe remove index main
WARNING: Server Certificate Warning - ignore this

cannot remove idx=main, is internal

C:\Program Files\Splunk\bin>

so, we can not remove the default index(es), thanks. 

[inventsekar]

Hi @erikhill  may i know if the above reply solves your query, if not, pls let us know more details. 

if yes, could you pls accept it as solution, thanks. 

[erikhill]

I appreciate the response @inventsekar , thank you.  I have a main index that I don't need anymore and I'd like to remove. If the index can't be deleted, can all of the data be removed from the index?

[PickleRick]

If you already ingested some data into this index and you don't need/want it in your instance anymore you can set a short retention period so that data is quickly rolled out and removed from the index. It's the easiest and most elegant way.

[erikhill]

Great! Thanks @PickleRick , I'll give that a shot!