Is it safe to clear event data from _internal?

1	Is it safe to clear the _internal index like this? Or should this never be done in the first place? What are the issues that could arise from doing this? $SPLUNK_HOME/bin/splunk clean eventdata -index _internal index asked 02 May '10, 20:00 rayfoo 178●1●1●10 accept rate: 12%

2 Answers:

Yes, it's safe to do. Other than not having the internal logs anymore, it doesn't cause any harm.

link

answered 02 May '10, 22:38

gkanapathy ♦
26.2k●1●6●22
accept rate: 42%

I did this, so what do I need to do if I want it enabled again ? I see the directory for _internal growing but search just isn't seeing it anymore.

(24 Jan, 11:31) rsia23

0	I did this, so what do I need to do if I want it enabled again ? I see the directory for _internal growing but search just isn't seeing it anymore. link answered 24 Jan, 14:34 rsia23 31●1 accept rate: 0%

Post your answer

toggle preview

Email:

RSS:

Answers

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

Tags:

index ×299

Asked: 02 May '10, 20:00

Seen: 1,030 times

Last updated: 24 Jan, 14:34