Knowledge Management

Is it safe to clear event data from _internal?

rayfoo
Path Finder

Is it safe to clear the _internal index like this? Or should this never be done in the first place? What are the issues that could arise from doing this?

$SPLUNK_HOME/bin/splunk clean eventdata -index _internal

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes, it's safe to do. Other than not having the internal logs anymore, it doesn't cause any harm.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Yes, it's safe to do. Other than not having the internal logs anymore, it doesn't cause any harm.

rsia23
Explorer

I did this, so what do I need to do if I want it enabled again ? I see the directory for _internal growing but search just isn't seeing it anymore.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...