Getting Data In

Deleting an index in a distributed Splunk deployment

danielsofoulis
Path Finder

I would like to delete an index in Splunk using the following command.

splunk remove index

Just wondering where I should run this command? e.g. only on the Cluster Master (CM)? or on the indexers and CM?

I'm aware that data which is pointed to this index will be lost, any other risks I should be aware of?

0 Karma

jkat54
SplunkTrust
SplunkTrust

In a distributed peer/indexer cluster you remove the index from /opt/splunk/etc/master-apps/_cluster/local/indexes.conf OR /opt/splunk/etc/master-apps/YourIndexApp/(local|default)/indexes.conf on the cluster master and then push the cluster configuration bundle from the cluster master.

You should read this first:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Managecommonconfigurations

then this:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Configurethepeerindexes

danielsofoulis
Path Finder

Does this method of deleting indexes only remove the index from searching, but the data in that index is still stored on the servers? is that correct?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Yes that is correct, it leaves the index on the disk still consuming disk space but stops any additional events from being written to the index and stops allowing it to be searched. To remove the files you have to log into each indexer and remove the index under /opt/splunk/var/lib/splunk/ (I believe that's the path, usually get it mixed up but /opt/splunk/var/lib/ is the root dir for sure).

jkat54
SplunkTrust
SplunkTrust

The path the old data will be stored in will depend on the home data path and cold data path settings that were in indexes.conf.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...