What is the proper way to remove forwarders and all data associated with their index in an indexer clustering environment?

[ddrillic]

We're wondering what is the proper way to remove a list of forwarders from a cluster and all the data associated with their index?

[Jeremiah · Accepted solution]

This answer comes with a big "it depends".

Do you want to stop using splunk altogether on your clients? Then stop the forwarder and disable it from starting at bootup. If you are certain you no longer need the installation, then remove the software.

Do you want to re-route the data to another set of indexers? Replace the new destination in the forwarders' outputs.conf file. You can do this via the deployment server if that's what you use to manage your forwarders, or via a script using the cli or your favorite provisioning tool. Configuring the forwarding destination is covered here: http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Configureforwarderswithoutputs.confd

To remove the data from a cluster, take a look at this article:
https://answers.splunk.com/answers/83767/how-do-i-clean-a-clustered-index.html and this doc link
http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/RemovedatafromSplunk#How_to_delete

If your data is in a dedicated index, and you want to remove all of the data, then you can delete the index. If your data is intermingled with other data that you want to retain, then you should use the delete command.

[ddrillic]

Very much appreciated!!