Getting Data In

Remove Index Command Not Working

katzr
Path Finder

Hello,

I am looking to remove an index entirely. I ran the search "splunk remove index new_hires" where new_hires is the index name. This command did not remove the index. I have the ability to delete. Why didn't this command work? I am using splunk 6.3.3. I want to remove the entire index and all associated data. Thank you!

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @katzr, here's documentation to remove indexes and indexed data. http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/RemovedatafromSplunk#Remove_an_index_entir... It has that CLI command but has a step beforehand directing you make sure no inputs.conf are directing data to the index you plan to delete.

0 Karma

katzr
Path Finder

yes- there are none and I didn't get a warning message that there are any.

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Are you using the [http://docs.splunk.com/Documentation/Splunk/latest/Admin/AbouttheCLI?r=searchtip[ (CLI)? Verifying due to your usage of "ran the search".

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

If so, refer to @kmorris's detailed explanation above! 🙂

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Do you have multiple indexers?

kmorris_splunk
Splunk Employee
Splunk Employee

I just noticed that you "ran the search" to remove the index. This is actually a command you would need to run via the CLI. Are you the administrator of the Splunk instance? If this is a single server instance (meaning you downloaded from splunk.com and installed it), then you should be able to remove the index from the GUI. However, if it is a distributed environment (meaning a separate search head, and multiple indexers, then the index would need to be removed from each indexer, via command line, using the command you typed in the search bar it seems.

katzr
Path Finder

no I don't believe so- is there anywhere I can check to make sure I don't.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

The delete command deletes event data from subsequent searches. It does not remove it from disk.

To remove data permanently from an index, use the CLI clean command.

See Remove indexes and indexed data in the Managing Indexers and Clusters of Indexers manual.

katzr
Path Finder

Do I need to clean the data before removing the entire index?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...