Getting Data In

Compact indexes after piping search results to 'delete'

mce128
Explorer

Is there a way to compact the indexes after a search that is piped through to the 'delete' command so as to recover disk space? If so how? I haven't been able to find it in the docs or from searching here and around the web. If not, does anyone know if implementing this is on the timeline somewhere?

Thanks!

0 Karma

kristian_kolb
Ultra Champion

No, the docs quite explicitly states that the delete operation will not free up disk space. If that had been an easily implemented feature, it would probably have been the default behaviour of delete.

/K

mce128
Explorer

@YannK: yes, it is a very misleading name for the command given its behavior to a degree, even more so if there is no intent to ever implement a compaction method. However, if it was intended to implement a compaction at a later time, then it does make sense as it is likely doing something similar to what a typical database does or say what email clients do, where it flags the record for deletion so that it does not display, and then when compaction is executed,

0 Karma

mce128
Explorer

@Kristian: Yes, I am aware that the docs explicitly state that delete does not free disk space. My purpose in asking was to see if perhaps the behavior had been changed and the docs not also changed to reflect that. I mean let's face it, it certainly wouldn't be the first time that happened for a piece of software! Alternatively to see if it was on the timeline if it hadn't yet been implemented.

0 Karma

yannK
Splunk Employee
Splunk Employee

"delete" is the most misleading command, it should be "hide"

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...