Getting Data In

What is the proper way to remove forwarders and all data associated with their index in an indexer clustering environment?

Ultra Champion

We're wondering what is the proper way to remove a list of forwarders from a cluster and all the data associated with their index?

0 Karma
1 Solution

Motivator

This answer comes with a big "it depends".

Do you want to stop using splunk altogether on your clients? Then stop the forwarder and disable it from starting at bootup. If you are certain you no longer need the installation, then remove the software.

Do you want to re-route the data to another set of indexers? Replace the new destination in the forwarders' outputs.conf file. You can do this via the deployment server if that's what you use to manage your forwarders, or via a script using the cli or your favorite provisioning tool. Configuring the forwarding destination is covered here: http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Configureforwarderswithoutputs.confd

To remove the data from a cluster, take a look at this article:
https://answers.splunk.com/answers/83767/how-do-i-clean-a-clustered-index.html and this doc link
http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/RemovedatafromSplunk#How_to_delete

If your data is in a dedicated index, and you want to remove all of the data, then you can delete the index. If your data is intermingled with other data that you want to retain, then you should use the delete command.

View solution in original post

Motivator

This answer comes with a big "it depends".

Do you want to stop using splunk altogether on your clients? Then stop the forwarder and disable it from starting at bootup. If you are certain you no longer need the installation, then remove the software.

Do you want to re-route the data to another set of indexers? Replace the new destination in the forwarders' outputs.conf file. You can do this via the deployment server if that's what you use to manage your forwarders, or via a script using the cli or your favorite provisioning tool. Configuring the forwarding destination is covered here: http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Configureforwarderswithoutputs.confd

To remove the data from a cluster, take a look at this article:
https://answers.splunk.com/answers/83767/how-do-i-clean-a-clustered-index.html and this doc link
http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/RemovedatafromSplunk#How_to_delete

If your data is in a dedicated index, and you want to remove all of the data, then you can delete the index. If your data is intermingled with other data that you want to retain, then you should use the delete command.

View solution in original post

Ultra Champion

Very much appreciated!!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!