Deployment Architecture

What happens to the Search head Data after you migrate from signal install to cluster



We are moving from a single install to a cluster.

The production machine is going to be used as a search head, can we delete the data on the search head that is now copied to another machine(new indexer)?

Is the below correct to delete for each index, so we keep the structure of the Indexer on the search head, but we remove the data as its just taking up space.

  • /splunk/mlc_live/db
  • /splunk/mlc_live/colddb
  • /splunk/mlc_live/datamodel_summary

Thanks in advance


Labels (1)
0 Karma


brill thanks

0 Karma


If your data is already copied to the new indexer(s) then, yes, it can be removed from the search head.  The indexes.conf files will specify the locations of the data, but there's no need to keep the directory structure since the SH doesn't use it.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...