You could do it this way:
Make sure that no inputs.conf is sending data to that index. Generally, it is okay to downsize an index while it is still being used, but the settings you will use here are pretty extreme. And you are deleting the index in the last step.
Make sure that you have specified a coldToFrozenDir - it can be anywhere that you like
Set the frozenTimePeriodInSecs to a small value like 86400 (1 day).
Wait until the time period is up.
Use this search | dbinspect index=yourindex span=7d to check that you do not have any buckets with data in them. You should still have hot buckets, but the event count should be zero.
Archive everything in the frozen directory.
Delete the directory containing the index (its location is specified in indexes.conf )
Delete the index stanza from indexes.conf .
[yourindex]
...
frozenTimePeriodInSecs=86400
coldToFrozenDir=/tmp/directoryforfrozenbuckets
... View more