Is it safe to remove restored buckets in thaweddb without stopping splunkd?

[melonman]

Hi

I am looking for a answer about how to remove safely from the restored buckets from thaweddb directory after restoring/rebuilding archived buckets into thaweddb.

Is it safe to simply remove the restored buckets from thaweddb directory without stopping splunkd?
I would like to know if there is a specific procedure for this operation.

The restored buckets can be safely removed without splunkd by rm commands?

Thank you in advance,

[Splunk_Shinobi · Accepted solution]

I usually stop splunk web to avoid any access while deleting the buckets.
It should work without stopping splunkd while deleteing buckets in thaweddb, but to be sate, better to stop if allowed.