I am summarizing my data every minute but I do not need that data after one hour. So I have schedule another search to run every hour to delete this old data. But I am realizing it is not freeing up the disk space. Am I missing anything? Do I need to do something more than just calling the | delete
command?
The delete search command is only a "soft" delete ie: marks events as being deleted.
To do a hard delete, you need to delete the index or roll it off to frozen bucket with an aggressive frequency.
The delete search command is only a "soft" delete ie: marks events as being deleted.
To do a hard delete, you need to delete the index or roll it off to frozen bucket with an aggressive frequency.
Please look at the answer posted here.
http://splunk-base.splunk.com/answers/1484/how-do-i-delete-events
Deleting events does not reclaim disk space.