Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk SOAR
- :
- Containers still there after running delete_contai...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi guys,
Phantom 4.10.7, I tried to delete containers older than 6 months via delete_containers.pyc and it confirmed counts of affected containers, artifacts and run records as expected, but after confirming the deletion and waiting for a few seconds until the command was done, I can still see the containers via UI.
If I rerun the delete_containers command again with the same parameters, it says there is nothing there to be deleted.
Anyone has any idea of what is going on? I need to housekeep the environment due to the surge of disk usage and there is no better way IMO as this one. Any suggestions are highly appreciated
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Found the solution here in this thread:
In a nutshell, delete_containers and delete_indicator scripts just "hide" them for visibility, but don't actually physically remove the space allocated to them in the database, so after deleting it you need to manually log into the database and run a VACCUM FULL in the affected table.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Found the solution here in this thread:
In a nutshell, delete_containers and delete_indicator scripts just "hide" them for visibility, but don't actually physically remove the space allocated to them in the database, so after deleting it you need to manually log into the database and run a VACCUM FULL in the affected table.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
How to find the worst searches in your Splunk environment and how to fix them
Share Your Feedback: On Admin Config Service (ACS)!
Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon
