Is this a good way to delete an index including future timestamps in a clustered env?

[tkw03]

Hello

My _internal index has grown past the 30 days of retention to 360+ days. This is due to future timestamps in the data keeping them from rolling.

I want to just remove the entire index from the cluster.

My plan was to make the changes on the cluster master, set frozen time secs like 60 and set maxHotSpanSecs to 3600(1 hr). and push them out

Once the cluster restarts I will remove the settings and push again.

Does this sound like a good plan? Will this remove all of the data including the future data?

Thanks for the thoughts!

[richgalloway · Accepted solution]

The first step is to correct the reason for the future timestamps.  Otherwise, you'll be back in the same situation soon.

Your solution should work.  You can also clean the index explicitly in the CLI using splunk clean eventdata -index _internal.  Run it on each indexer.

[tkw03]

The only reason I didn't want to clean is that I would have to shutdown the entire cluster and the master, and clean each one individually.

Thanks for the confirmation! I did run it as planned.