Hi, and sorry if this question was already answered in any other thread. Thanks in advance for the help. I had an index in which the current size was over 10 GB, for deleting the data I tried t...
See more...
Hi, and sorry if this question was already answered in any other thread. Thanks in advance for the help. I had an index in which the current size was over 10 GB, for deleting the data I tried to reduce it's max size and searchable retention. My question is what is going to happen with the data? Will it be deleted from the servers or archived? I am confused because I am seeing the event counts stuck with the same value as it was before changing the retention config. Previous index config: Current Size 10 GB, Max Size: 0, Event Count: 10M, Earliest Event: 5 Months, Latest Event: 1 day, Searchable Retention: 365 days, Archive Retention: blank, Self Storage: blank, Status: enabled Then, I changed the parameters "Max Size" to "200 MB" and "Searchable Retention" to "1 Day". Besides, when running the following query, I see the warm storage size pretty much with the same size (bouncing a few mbs). |dbinspect index=_internal *<index-name>*
| stats sum(sizeOnDiskMB) by state Any help greatly appreciated.