Getting Data In

What is the proper way to remove forwarders and all data associated with their index in an indexer clustering environment?

ddrillic
Ultra Champion

We're wondering what is the proper way to remove a list of forwarders from a cluster and all the data associated with their index?

0 Karma
1 Solution

Jeremiah
Motivator

This answer comes with a big "it depends".

Do you want to stop using splunk altogether on your clients? Then stop the forwarder and disable it from starting at bootup. If you are certain you no longer need the installation, then remove the software.

Do you want to re-route the data to another set of indexers? Replace the new destination in the forwarders' outputs.conf file. You can do this via the deployment server if that's what you use to manage your forwarders, or via a script using the cli or your favorite provisioning tool. Configuring the forwarding destination is covered here: http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Configureforwarderswithoutputs.confd

To remove the data from a cluster, take a look at this article:
https://answers.splunk.com/answers/83767/how-do-i-clean-a-clustered-index.html and this doc link
http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/RemovedatafromSplunk#How_to_delete

If your data is in a dedicated index, and you want to remove all of the data, then you can delete the index. If your data is intermingled with other data that you want to retain, then you should use the delete command.

View solution in original post

Jeremiah
Motivator

This answer comes with a big "it depends".

Do you want to stop using splunk altogether on your clients? Then stop the forwarder and disable it from starting at bootup. If you are certain you no longer need the installation, then remove the software.

Do you want to re-route the data to another set of indexers? Replace the new destination in the forwarders' outputs.conf file. You can do this via the deployment server if that's what you use to manage your forwarders, or via a script using the cli or your favorite provisioning tool. Configuring the forwarding destination is covered here: http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Configureforwarderswithoutputs.confd

To remove the data from a cluster, take a look at this article:
https://answers.splunk.com/answers/83767/how-do-i-clean-a-clustered-index.html and this doc link
http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/RemovedatafromSplunk#How_to_delete

If your data is in a dedicated index, and you want to remove all of the data, then you can delete the index. If your data is intermingled with other data that you want to retain, then you should use the delete command.

View solution in original post

ddrillic
Ultra Champion

Very much appreciated!!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!