how to cleanup splunk space through script

[asimsk84]

how to cleanup splunk space through script. I don't have a script. How to create a script to help clean up splunk space and delete old files. not getting reporting; it's not uploading any logs.

[gcusello]

Hi @asimsk84 ,

sorry, but why do you want to use a script to clean old Splunk data files?

You can set up a retention time (adding to each index the parameter frozenTimePeriodInSecs) and Splunk automaticall removes the old buckets in a correct way.

Ciao.

Giuseppe

[splunkreal]

Hello @asimsk84 welcome!

depending on your retention policy on indexes.conf old buckets won't be frozen and will be deleted : https://community.splunk.com/t5/Getting-Data-In/Do-I-need-to-define-coldToFrozenDir-in-indexes-conf-...

Doc : https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/Indexesconf%20%22coldToFrozenDir%22

You should not delete any file yourself, leave Splunk manage.