Is it safe to delete all frozen buckets from coldToFrozenDir manually from the indexers, while the cluster is up and running?
We have one big ColdToFrozenDir, to which all frozen buckets are copied from all indexes. Since this is called an archive, I would expect that splunk doesn't care when I delete them. Is this true?
Thanks!
↧