Deployment Architecture
Highlighted

Removed index from clustered environment

Path Finder

What is the best way to remove an index from a clustered environment?
On our DEV env I have removed it from indexes.conf on master and done an 'apply'. So it has disappeared from the cluster dashboard and from the indexes dashboard on the peers however the index directory structure is still there on the peers. Can I just delete them ( rm -rf ) or do I need to do anything else?
Splunk version is 5.0.2 and 5.0.5

Thanks

0 Karma
Highlighted

Re: Removed index from clustered environment

Explorer

You don't need anything else. Remove from the master config, apply bundle, wait for all indexers to restart, delete the data.

-Stefan

Highlighted

Re: Removed index from clustered environment

Path Finder

Thanks Stefan.

0 Karma