Deployment Architecture

What happens to the Search head Data after you migrate from signal install to cluster



We are moving from a single install to a cluster.

The production machine is going to be used as a search head, can we delete the data on the search head that is now copied to another machine(new indexer)?

Is the below correct to delete for each index, so we keep the structure of the Indexer on the search head, but we remove the data as its just taking up space.

  • /splunk/mlc_live/db
  • /splunk/mlc_live/colddb
  • /splunk/mlc_live/datamodel_summary

Thanks in advance


Labels (1)
0 Karma


brill thanks

0 Karma


If your data is already copied to the new indexer(s) then, yes, it can be removed from the search head.  The indexes.conf files will specify the locations of the data, but there's no need to keep the directory structure since the SH doesn't use it.

If this reply helps you, an upvote would be appreciated.
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!