How do you delete an index from a Splunk deployment with a non-clustered Indexer setup?

[aknsun]

Hi,

I would like to remove an index using the Splunk remove index command.

My environment has a non-clustered Indexer setup ( to be soon clustered), but with a Clustered SH deployment.

Can you let me know the Best Practice to delete an index for the above mentioned deployment?

Do I need to run the command on all Indexers?

Thanks,

AKN

[richgalloway · Accepted solution]

Yes, you must remove the index from all indexers on which it is present.
It's not necessary, but is a good practice to also remove the index from your search heads. Do that by editing the indexes.conf file in the appropriate app on your SHC deployer, then deploy.

[aknsun]

@richgalloway . Thanks for the quick response.

[aknsun]

Hi,
@richgalloway
I still see reference to the deleted Index on the DMC under Settings-> Monitoring Console -> Indexing -> Indexes and Volumes-> "Indexes and Volumes: Deployment".
The Indexers have not been restarted after the Index removal. Neither has the DMC been restarted,