Hi,
I would like to remove an index using the Splunk remove index command.
My environment has a non-clustered Indexer setup ( to be soon clustered), but with a Clustered SH deployment.
Can you let me know the Best Practice to delete an index for the above mentioned deployment?
Do I need to run the command on all Indexers?
Thanks,
AKN
Yes, you must remove the index from all indexers on which it is present.
It's not necessary, but is a good practice to also remove the index from your search heads. Do that by editing the indexes.conf file in the appropriate app on your SHC deployer, then deploy.
Yes, you must remove the index from all indexers on which it is present.
It's not necessary, but is a good practice to also remove the index from your search heads. Do that by editing the indexes.conf file in the appropriate app on your SHC deployer, then deploy.
@richgalloway . Thanks for the quick response.
Hi,
@richgalloway
I still see reference to the deleted Index on the DMC under Settings-> Monitoring Console -> Indexing -> Indexes and Volumes-> "Indexes and Volumes: Deployment".
The Indexers have not been restarted after the Index removal. Neither has the DMC been restarted,