Will uninstalling a search head from a distributed search environment using Add/Remove programs remove it from the topology, or are there additional steps?

[wjmurphy]

We have a distributed Splunk Enterprise environment running 6.1. There are two search heads. I believe the original goal was to set up search head pooling. Before I upgrade to 6.2.x, I'd like to clean out this old search head that doesn't appear to be used for anything (Splunkd and Splunkweb services have been disabled on this since I inherited it.) Will running the uninstall from Add/Remove programs remove it out of the topology or are additional steps required?

Thanks

[jensonthottian]

check using _internal index as to what the old SH is being used for. You may want to move all the views, alerts, saved searches, report and apps from this SH, maybe create a backup.

[tskinnerivsec]

It won't be part of the installation any more after your uninstall, but there will likely be some cleanup that needs to be done, depending on how your environment is set up. Most of it will be house keeping type things. Some examples of this will be if you were using the distributed management console, you would need to remove the search head as a search peer to keep it from alerting in the console. If you are using the sos app, /opt/splunk/etc/apps/sos/lookups/splunk_servers_cache.csv to get it out of the list on the sos app. If you were forwarding its logs to indexers, you will still see it show up in some internal searches if activity has occurred on it in the recent past. etc.