Space on searchnode is getting full

[rohan0017]

I have a 10TB search node and it is now filled with 9TB of data, how to archive the current data so that I can free up some space. Is there any archiving facility in securityonion. Orshould I take backup manually.

[InfosecGoon]

There is no archiving functionality -- if you need more space, you'll need to either add disk to your existing node, add another Search Node, or delete some old data. By default, your Search Node should start deleting closed indices oldest-first once /nsm reaches 80% utilization.