Have a clustered environment of 3 indexers. Data in the indexers was used to test full architecture capability.
dont need the data anymore in the indexers as would like to start off with clean slate on indexers.
Would like to move existing data to a frozen bucket, as we been told repeatedly it is not a good idea to delete indexer data.
Looking for recommendation on best path and feasibility.
You could do it this way:
coldToFrozenDir
- it can be anywhere that you likefrozenTimePeriodInSecs
to a small value like 86400 (1 day).| dbinspect index=yourindex span=7d
to check that you do not have any buckets with data in them. You should still have hot buckets, but the event count should be zero.indexes.conf
)Delete the index stanza from indexes.conf
.
[yourindex]
...
frozenTimePeriodInSecs=86400
coldToFrozenDir=/tmp/directoryforfrozenbuckets