I have run out of disk space on my indexers. I need to reclaim space and want to purge data from some of the indexes but save the data in others. How would I do that?
You can edit the indexes.conf on the indexers, and specify a time retention on a per index basis. (frozenTimePeriodInSecs)
I would also consider using a combination of maxTotalDataSizeMB, homePath.maxDataSizeMB, and coldPath.maxDataSizeMB to control indice size.
You can adjust the retention of your index and it will start freezing old buckets or you can use the delete command to be more selective:
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Delete