Splunk Enterprise

clean main index

omershira
Explorer

Hello,

My team and I installed a new UF on one of our systems.

we wanted it to send the data from the system to a specific index we made for it.

after we installed the UF it immediately started to transfer data to the main index since its the default.

then I stopped the UF and changed the inputs.conf file so it will send the data to the specific  index and it did right when I started the UF again. 

The problem is that now there is still data in the main index. the indexes in the environment are clustered so the option of "splunk clean eventdata -index main" will not work on that case...

I couldn't find anothe solution, can you please help me?

thanks,

omer shira.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Set frozenTimePeriodInSecs = 30 for that index and restart the indexers.  Allow a few minutes for the indexers to clean out main.  Once you see the index is empty, restore the original value and restart the indexers again.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Set frozenTimePeriodInSecs = 30 for that index and restart the indexers.  Allow a few minutes for the indexers to clean out main.  Once you see the index is empty, restore the original value and restart the indexers again.

---
If this reply helps you, Karma would be appreciated.

omershira
Explorer

Hi, it worked! thanks!!

omershira
Explorer

Thanks!

I will give it a try and let you know!

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...