Splunk Enterprise

Is this a good way to delete an index including future timestamps in a clustered env?

tkw03
Communicator

Hello

My _internal index has grown past the 30 days of retention to 360+ days. This is due to future timestamps in the data keeping them from rolling.

I want to just remove the entire index from the cluster.

My plan was to make the changes on the cluster master, set frozen time secs like 60 and set maxHotSpanSecs to 3600(1 hr). and push them out

Once the cluster restarts I will remove the settings and push again.

Does this sound like a good plan? Will this remove all of the data including the future data?

Thanks for the thoughts!

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The first step is to correct the reason for the future timestamps.  Otherwise, you'll be back in the same situation soon.

Your solution should work.  You can also clean the index explicitly in the CLI using splunk clean eventdata -index _internal.  Run it on each indexer.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first step is to correct the reason for the future timestamps.  Otherwise, you'll be back in the same situation soon.

Your solution should work.  You can also clean the index explicitly in the CLI using splunk clean eventdata -index _internal.  Run it on each indexer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

tkw03
Communicator

The only reason I didn't want to clean is that I would have to shutdown the entire cluster and the master, and clean each one individually.

Thanks for the confirmation! I did run it as planned.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...