Knowledge Management

Free up space on the index

romitsn
New Member

I have quite a few hot db and warm in one of my index - sharp. Can I delete the files under the rawdata directory like the journal.gz to clean up some space?

Will that impact the index in any way?

Tags (3)
0 Karma

Ayn
Legend

Um yes, it is definitely going to impact things. The journal is part of how Splunk stores and makes data searchable. If you start deleting this or other files in the index directories Very Bad Things start happening.

martin_mueller
SplunkTrust
SplunkTrust

To free up space on that index you can set the maximum size for the index to a smaller value. Then Splunk will clean up old stuff without breaking buckets.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...