topic How do you create and delete the indexers using shell or Python? in Getting Data In

How do you create and delete the indexers using shell or Python?

impsk — Fri, 08 Mar 2019 15:41:35 GMT

Hello,

I'm new to scripting can anyone please help me out to create and delete indexers using shell or Python?

I've gone through every document in Splunk for deleting/creating, but it's in CLI.

Much appreciated.

Re: How do you create and delete the indexers using shell or Python?

nickhills — Fri, 08 Mar 2019 15:51:39 GMT

You can totally do this, but there is a huge amount to consider.

Creating and removing indexers should not be done lightly - depending on your configuration, there is huge potential to loose data irretrievably, and/or render your entire deployment unrecoverable.

With that said, if you are using S2, this becomes significantly more achievable, but the scale down process still needs a number of things to run first to roll off hot buckets to S2.

I suppose at this stage, its worth asking the question:
Is this for a test/dev/lab environment (where you don't care about the data) or is this Prod and you need to preserve the data?

If its the latter, I very strongly suggest you engage with Splunk PS and take their guidance, as there is a lot to think about.

Re: How do you create and delete the indexers using shell or Python?

impsk — Fri, 08 Mar 2019 16:13:04 GMT

Its right now for a test purpose .

for say : deleting the indexer from splunk below three steps should be prcoessed but as said earlier i'm new to scripting it would be grace if you can help me out with this:

#!/usr/bin/env bash
/opt/splunk/bin ./splunk stop
./splunk clean eventdata -index indexname
./splunk start