Hello Splunkers,
My _internaldb and _introspection indexes are getting bigger and I am wondering if I can delete some events in order to reduce their sizes ? How would I do that ? Is it safe to do it ?
Thanks for your time !
GaetanVP
Hi
you could set retention times etc. as any other indexes have. I prefer to use separate app/SA which contains these definitions. Then just install it on your indexer or via cluster master.
r. Ismo