How remove old index=main data after an indexer cluster migration?

[kwanx]

Hello!

Prior to Jan 2015, I had a single Server Splunk Environment; in Jan 2015 I migrated to a 4 node environment consisting of Search head (this server was the single splunk platform prior to Jan 2015), Master/Slave/Slave(new servers installed); This new cluster has worked great since then.

Now I wish to clean up 300 GB of data on the now Search Head in main index of /opt/splunk/var/lib/splunk/defaultdb/db. This data was from when the now search head server was the sole provider of all Splunk functions prior to Jan 2015; the data has not been touched since Jan 2015. (as verified in GUI as well as CLI on server)

When I try to disable main from GUI I get:

"Error occurred attempting to disable main: In handler 'indexes': cannot disable idx=main, is internal."

Please assist on how I can remove this old /opt/splunk/var/lib/splunk/defaultdb/db data from my search head without damaging my new data that is on the 2 Slave nodes.

[martin_mueller]

You can stop the search head and move the buckets (db_epoch1_epoch2_id directories) inside /opt/splunk/var/lib/splunk/defaultdb/db to a different place on that machine, then start the search head again. It'll start normally, all your data will still be on the cluster peers, and once verified you can properly delete the buckets.

[kwanx]

Thank you martin - I will give that a try and let it ride a day before deleting old data, then report back.