Deployment Architecture

What happens to the Search head Data after you migrate from signal install to cluster

robertlynch2020
Motivator

Hi

We are moving from a single install to a cluster.

The production machine is going to be used as a search head, can we delete the data on the search head that is now copied to another machine(new indexer)?

Is the below correct to delete for each index, so we keep the structure of the Indexer on the search head, but we remove the data as its just taking up space.

  • /splunk/mlc_live/db
  • /splunk/mlc_live/colddb
  • /splunk/mlc_live/datamodel_summary

Thanks in advance

Rob

Labels (1)
0 Karma

robertlynch2020
Motivator

brill thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your data is already copied to the new indexer(s) then, yes, it can be removed from the search head.  The indexes.conf files will specify the locations of the data, but there's no need to keep the directory structure since the SH doesn't use it.

---
If this reply helps you, an upvote would be appreciated.
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!