Hello
What is the recommended way to clear an index present on all our indexers and then make all the universal forwarders re-send all the events on respective Windows server?
Once you clean your Indexer, you will also have to reset your fishbucket on your Universal forwarder. Without reseting the fishbucket, you won't be able to have your server resend all the data. Easiest way to do it is to stop the Universal Forwarder and then delete the fishbucket from /Splunkforwarder/var/lib/splunk/fishbucket
You can find all the info you need for deleting the Indexes and all here:
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk
Once you clean your Indexer, you will also have to reset your fishbucket on your Universal forwarder. Without reseting the fishbucket, you won't be able to have your server resend all the data. Easiest way to do it is to stop the Universal Forwarder and then delete the fishbucket from /Splunkforwarder/var/lib/splunk/fishbucket
You can find all the info you need for deleting the Indexes and all here:
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk
Clean indexes in a multisite indexer cluster following these steps:
./splunk offline command on each indexer
./splunk clean eventdata
./splunk start on all indexers
This procedure worked fine for us, the master had to rebalance some stuff but didnt' had any remarkable errors or warnings and fixed all buckets as it should.
Also there is other way given here,
https://answers.splunk.com/answers/387161/official-way-to-clean-indexed-data-from-index-clus.html
This worked perfectly. I cannot select two answers as an "accepted answer" though 😐
Happy to help!! 🙂