Getting Data In
Highlighted

How do you delete an index from a Splunk deployment with a non-clustered Indexer setup?

Path Finder

Hi,

I would like to remove an index using the Splunk remove index command.

My environment has a non-clustered Indexer setup ( to be soon clustered), but with a Clustered SH deployment.

Can you let me know the Best Practice to delete an index for the above mentioned deployment?

Do I need to run the command on all Indexers?

Thanks,

AKN

Tags (2)
0 Karma
Highlighted

Re: How do you delete an index from a Splunk deployment with a non-clustered Indexer setup?

SplunkTrust
SplunkTrust

Yes, you must remove the index from all indexers on which it is present.
It's not necessary, but is a good practice to also remove the index from your search heads. Do that by editing the indexes.conf file in the appropriate app on your SHC deployer, then deploy.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: How do you delete an index from a Splunk deployment with a non-clustered Indexer setup?

Path Finder

@richgalloway . Thanks for the quick response.

0 Karma
Highlighted

Re: How do you delete an index from a Splunk deployment with a non-clustered Indexer setup?

Path Finder

Hi,
@richgalloway
I still see reference to the deleted Index on the DMC under Settings-> Monitoring Console -> Indexing -> Indexes and Volumes-> "Indexes and Volumes: Deployment".
The Indexers have not been restarted after the Index removal. Neither has the DMC been restarted,

0 Karma