Getting Data In

What is the proper way to remove forwarders and all data associated with their index in an indexer clustering environment?

ddrillic
Ultra Champion

We're wondering what is the proper way to remove a list of forwarders from a cluster and all the data associated with their index?

0 Karma
1 Solution

Jeremiah
Motivator

This answer comes with a big "it depends".

Do you want to stop using splunk altogether on your clients? Then stop the forwarder and disable it from starting at bootup. If you are certain you no longer need the installation, then remove the software.

Do you want to re-route the data to another set of indexers? Replace the new destination in the forwarders' outputs.conf file. You can do this via the deployment server if that's what you use to manage your forwarders, or via a script using the cli or your favorite provisioning tool. Configuring the forwarding destination is covered here: http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Configureforwarderswithoutputs.confd

To remove the data from a cluster, take a look at this article:
https://answers.splunk.com/answers/83767/how-do-i-clean-a-clustered-index.html and this doc link
http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/RemovedatafromSplunk#How_to_delete

If your data is in a dedicated index, and you want to remove all of the data, then you can delete the index. If your data is intermingled with other data that you want to retain, then you should use the delete command.

View solution in original post

Jeremiah
Motivator

This answer comes with a big "it depends".

Do you want to stop using splunk altogether on your clients? Then stop the forwarder and disable it from starting at bootup. If you are certain you no longer need the installation, then remove the software.

Do you want to re-route the data to another set of indexers? Replace the new destination in the forwarders' outputs.conf file. You can do this via the deployment server if that's what you use to manage your forwarders, or via a script using the cli or your favorite provisioning tool. Configuring the forwarding destination is covered here: http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Configureforwarderswithoutputs.confd

To remove the data from a cluster, take a look at this article:
https://answers.splunk.com/answers/83767/how-do-i-clean-a-clustered-index.html and this doc link
http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/RemovedatafromSplunk#How_to_delete

If your data is in a dedicated index, and you want to remove all of the data, then you can delete the index. If your data is intermingled with other data that you want to retain, then you should use the delete command.

ddrillic
Ultra Champion

Very much appreciated!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...