Deployment Architecture

Removed index from clustered environment

TONYBYERS
Path Finder

What is the best way to remove an index from a clustered environment?
On our DEV env I have removed it from indexes.conf on master and done an 'apply'. So it has disappeared from the cluster dashboard and from the indexes dashboard on the peers however the index directory structure is still there on the peers. Can I just delete them ( rm -rf ) or do I need to do anything else?
Splunk version is 5.0.2 and 5.0.5

Thanks

0 Karma

sbaryakov
Explorer

You don't need anything else. Remove from the master config, apply bundle, wait for all indexers to restart, delete the data.

-Stefan

TONYBYERS
Path Finder

Thanks Stefan.

0 Karma
Get Updates on the Splunk Community!

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...

Application management with Targeted Application Install for Victoria Experience

Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...