topic Re: How do you delete an index from a Splunk deployment with a non-clustered Indexer setup? in Getting Data In

How do you delete an index from a Splunk deployment with a non-clustered Indexer setup?

aknsun — Wed, 23 Jan 2019 05:21:58 GMT

Hi,

I would like to remove an index using the Splunk remove index command.

My environment has a non-clustered Indexer setup ( to be soon clustered), but with a Clustered SH deployment.

Can you let me know the Best Practice to delete an index for the above mentioned deployment?

Do I need to run the command on all Indexers?

Thanks,

AKN

Re: How do you delete an index from a Splunk deployment with a non-clustered Indexer setup?

richgalloway — Wed, 23 Jan 2019 14:03:37 GMT

Yes, you must remove the index from all indexers on which it is present.
It's not necessary, but is a good practice to also remove the index from your search heads. Do that by editing the indexes.conf file in the appropriate app on your SHC deployer, then deploy.

Re: How do you delete an index from a Splunk deployment with a non-clustered Indexer setup?

aknsun — Wed, 23 Jan 2019 21:44:32 GMT

@richgalloway . Thanks for the quick response.

Re: How do you delete an index from a Splunk deployment with a non-clustered Indexer setup?

aknsun — Tue, 29 Jan 2019 06:03:14 GMT

Hi,
@richgalloway
I still see reference to the deleted Index on the DMC under Settings-> Monitoring Console -> Indexing -> Indexes and Volumes-> "Indexes and Volumes: Deployment".
The Indexers have not been restarted after the Index removal. Neither has the DMC been restarted,