How to completely delete an index and remove it from the list of indexes that show up in splunkweb's manager >> indexes page?

Your doc is pointing to the 3.3 release of splunk, which is not relevant to 4.1. Use this link instead:

http://www.splunk.com/base/Documentation/latest/Admin/RemovedatafromSplunk

Never mind! I found the instructions for Splunk 4.2.1 to remove indexed data and completely delete the index.
Follow the links below:

Remove indexed data from Splunk

Completely delete an index (and not just the data contained in it)

It seems to be obvious once you know it, but before then, general instructions were so vague.

Thanks

try this rayfoo:

./splunk clean eventdata <indexName> -f

or this:

./splunk clean eventdata -index <indexName> -f

By the way, are you trying to remove the events from that particular index? Or are you trying to moving the index to another directory?

Has this question been answered?

How do you delete and index (completelly) from Splunk 4.1.3 (not just clear events).

Raj, did you get an answer to the question? I tried the old procedure, but the index is still visible (although disabled).

Not sure why the debate is still ongoing, Genti's answer above contains all the information you need to remove an index

1. Disable the index via Manager
2. Manually remove the data from disk and the entry from the relevant indexes.conf if desired

There is no feature to completely remove an index via the UI or the CLI

I'm sorry to revive this thread, but as of 4.2.1, it still seems like it is still not possible to remove/delete an index using the UI or CLI.

I find it somewhat bizarre that such feature just does not exist. I'm quite curious about it, as surely there must be a good reason for that.

Anyone knows why?

thx

It is now May 7, 2011, and I am using Splunk 4.2 build 96430. Does anyone have the answer? I am new to Splunk and learning how to develop apps and to manage the system.

I have followed the instruction above to remove an index. (Well, sort of! The instruction doesn't explictly spell out the "relevant index.conf" and the "all input.conf"). I located and viewed ALL index.conf and input.conf files under the $SPLUNK_HOME directory tree, but I found no trace of related stanzas or settings. Regardless of all my effords, the web screen at Splunk >> Manager >> Indexes still lists the index. Uh!

On the other hand, I used the CLI to remove, but it returned a message, "Command error: This command has been removed."

I wonder why the "splunk remove index {Index_Name}" command has been removed and why this version of Splunk has made a step backward, compared to the previous versions.

The system seems to be OK with the disabled index, but I want to tidy up my system.

I greatly appreciate any help I can get. Thanks

Hi bmnguyen,

Even i have been facing this issue (on Splunk 4.1.6) but have found only few links useful, sharing them here, hope they might help:

1. Tells how to delete an index in 4.2 and above versions: http://www.splunk.com/base/Documentation/4.2.1/Admin/RemovedatafromSplunk

2. indexes.conf file - good to know how the indexes are listed there. Link: http://www.splunk.com/base/Documentation/4.2.1/admin/Indexesconf

Hope these two links help. Do let me know if these helped you in resolving your issue or not.

Regards,

Mohit Vohra.