Getting Data In

Compact indexes after piping search results to 'delete'

mce128
Explorer

Is there a way to compact the indexes after a search that is piped through to the 'delete' command so as to recover disk space? If so how? I haven't been able to find it in the docs or from searching here and around the web. If not, does anyone know if implementing this is on the timeline somewhere?

Thanks!

0 Karma

kristian_kolb
Ultra Champion

No, the docs quite explicitly states that the delete operation will not free up disk space. If that had been an easily implemented feature, it would probably have been the default behaviour of delete.

/K

mce128
Explorer

@YannK: yes, it is a very misleading name for the command given its behavior to a degree, even more so if there is no intent to ever implement a compaction method. However, if it was intended to implement a compaction at a later time, then it does make sense as it is likely doing something similar to what a typical database does or say what email clients do, where it flags the record for deletion so that it does not display, and then when compaction is executed,

0 Karma

mce128
Explorer

@Kristian: Yes, I am aware that the docs explicitly state that delete does not free disk space. My purpose in asking was to see if perhaps the behavior had been changed and the docs not also changed to reflect that. I mean let's face it, it certainly wouldn't be the first time that happened for a piece of software! Alternatively to see if it was on the timeline if it hadn't yet been implemented.

0 Karma

yannK
Splunk Employee
Splunk Employee

"delete" is the most misleading command, it should be "hide"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...