Splunk SOAR

Containers still there after running delete_containers.pyc?

victor_menezes
Communicator

Hi guys,

 

Phantom 4.10.7, I tried to delete containers older than 6 months via delete_containers.pyc and it confirmed counts of affected containers, artifacts and run records as expected, but after confirming the deletion and waiting for a few seconds until the command was done, I can still see the containers via UI.

If I rerun the delete_containers command again with the same parameters, it says there is nothing there to be deleted.

Anyone has any idea of what is going on? I need to housekeep the environment due to the surge of disk usage and there is no better way IMO as this one. Any suggestions are highly appreciated

Labels (3)
0 Karma
1 Solution

victor_menezes
Communicator

Found the solution here in this thread:

https://community.splunk.com/t5/Splunk-SOAR-f-k-a-Phantom/What-is-the-proper-way-to-purge-SOAR-conta...

In a nutshell, delete_containers and delete_indicator scripts just "hide" them for visibility, but don't actually physically remove the space allocated to them in the database, so after deleting it you need to manually log into the database and run a VACCUM FULL in the affected table.

View solution in original post

0 Karma

victor_menezes
Communicator

Found the solution here in this thread:

https://community.splunk.com/t5/Splunk-SOAR-f-k-a-Phantom/What-is-the-proper-way-to-purge-SOAR-conta...

In a nutshell, delete_containers and delete_indicator scripts just "hide" them for visibility, but don't actually physically remove the space allocated to them in the database, so after deleting it you need to manually log into the database and run a VACCUM FULL in the affected table.

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...