Am I able to remove Indexer Search Peer - log4j?

[rlaan]

Hello, 
In a Log4J scan the following directory was flagged for containing comprimised log4j.jar files.

The files are contained in the below directory although the host being used is that of depricated servers in our infrastructure. I have migrated all of our splunk enterprise components to newer architecture and there exists 

I am curious if there is a correct way to remove the old hosts under searchpeer including all the <old_host>.* files. If unused can I just deleted them?

/opt/splunk/var/run/searchpeers/<old_host>-1641917646  (no longer exists)
/opt/splunk/var/run/searchpeers/<current_host>-1641917646   (active host in use)

File that is being caught by scan, 
/opt/splunk/var/run/searchpeers/<old_host->41917646/apps/splunk_archiver/java-bin/jars/vendors/spark/3.0.1/lib/log4j-core-2.13.3.jar

If the directories cant be safely removed i believe other documentation to say just the .jar can be removed safely.

[richgalloway]

Yes, the JAR file can be removed safely.

[rlaan]

Are you familiar with everything under the searchpeer directory can be removed if the host it reference has been decomisisoned? (old search head hosts that no longer exist)

[richgalloway · Accepted solution]

Yes, it is safe.  If you happen to delete something that is needed then the peer will get a new copy.