Deployment Architecture

Removed index from clustered environment

TONYBYERS
Path Finder

What is the best way to remove an index from a clustered environment?
On our DEV env I have removed it from indexes.conf on master and done an 'apply'. So it has disappeared from the cluster dashboard and from the indexes dashboard on the peers however the index directory structure is still there on the peers. Can I just delete them ( rm -rf ) or do I need to do anything else?
Splunk version is 5.0.2 and 5.0.5

Thanks

0 Karma

sbaryakov
Explorer

You don't need anything else. Remove from the master config, apply bundle, wait for all indexers to restart, delete the data.

-Stefan

TONYBYERS
Path Finder

Thanks Stefan.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...