Splunk Enterprise

clean main index

omershira
Explorer

Hello,

My team and I installed a new UF on one of our systems.

we wanted it to send the data from the system to a specific index we made for it.

after we installed the UF it immediately started to transfer data to the main index since its the default.

then I stopped the UF and changed the inputs.conf file so it will send the data to the specific  index and it did right when I started the UF again. 

The problem is that now there is still data in the main index. the indexes in the environment are clustered so the option of "splunk clean eventdata -index main" will not work on that case...

I couldn't find anothe solution, can you please help me?

thanks,

omer shira.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Set frozenTimePeriodInSecs = 30 for that index and restart the indexers.  Allow a few minutes for the indexers to clean out main.  Once you see the index is empty, restore the original value and restart the indexers again.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Set frozenTimePeriodInSecs = 30 for that index and restart the indexers.  Allow a few minutes for the indexers to clean out main.  Once you see the index is empty, restore the original value and restart the indexers again.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

omershira
Explorer

Hi, it worked! thanks!!

omershira
Explorer

Thanks!

I will give it a try and let you know!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!