Deployment Architecture

Removed index from clustered environment

Path Finder

What is the best way to remove an index from a clustered environment?
On our DEV env I have removed it from indexes.conf on master and done an 'apply'. So it has disappeared from the cluster dashboard and from the indexes dashboard on the peers however the index directory structure is still there on the peers. Can I just delete them ( rm -rf ) or do I need to do anything else?
Splunk version is 5.0.2 and 5.0.5

Thanks

0 Karma

Explorer

You don't need anything else. Remove from the master config, apply bundle, wait for all indexers to restart, delete the data.

-Stefan

Path Finder

Thanks Stefan.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!