Hi @somramsam, if you use the delete command (adding to your user the role "can_delete") you make the deleted data unsearchable, but they remain in the buckets. If instead you use the CLI command or you modify index retention, data will be physically removed. Remember that if you modify retention, data will be removed as a bucket, in other words you could still have data older than the retention period because they are in a bucket containing some data still in the retention period; the bucket will be removed whan the latest event exceeds the retention period. For more infos, see at https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/Setaretirementandarchivingpolicy Ciao. Giuseppe ... View more

hi @Jarohnimo  The 6.5 is EOL already and 7.2 is EOF as of last week. We thught we could directly jump to 8.1.3 but it seems like we can not since the schema has changed in 7.2. hence we had to bring our instance to 7.2, verify and then upgrade to 8.1.3. Per the email form @isoutamo , If I could verify 7.2 and attach the file and rsync, not sure if it is gonna work. I also need to upgrade our Linux to RHEL 8. Hope this helps! Thanks, Somi   ... View more