Splunk Enterprise

Is this a good way to delete an index including future timestamps in a clustered env?

tkw03
Communicator

Hello

My _internal index has grown past the 30 days of retention to 360+ days. This is due to future timestamps in the data keeping them from rolling.

I want to just remove the entire index from the cluster.

My plan was to make the changes on the cluster master, set frozen time secs like 60 and set maxHotSpanSecs to 3600(1 hr). and push them out

Once the cluster restarts I will remove the settings and push again.

Does this sound like a good plan? Will this remove all of the data including the future data?

Thanks for the thoughts!

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The first step is to correct the reason for the future timestamps.  Otherwise, you'll be back in the same situation soon.

Your solution should work.  You can also clean the index explicitly in the CLI using splunk clean eventdata -index _internal.  Run it on each indexer.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first step is to correct the reason for the future timestamps.  Otherwise, you'll be back in the same situation soon.

Your solution should work.  You can also clean the index explicitly in the CLI using splunk clean eventdata -index _internal.  Run it on each indexer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

tkw03
Communicator

The only reason I didn't want to clean is that I would have to shutdown the entire cluster and the master, and clean each one individually.

Thanks for the confirmation! I did run it as planned.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...