Thanks for your response. ... View more

So you cant delete the indexes, per say, without a restart. However, there are a few things you could potentially do.. index=deleteme | delete Delete all the events in the index (this doesnt actually delete, but marks them as deleted.) And this clean the index when time permits. Maintenance Mode and Delete Put your cluster into maintenance mode, this will prevent the bucket fixup activities across the cluster. While in maintenance mode, one by one, go through your indexers and clean / delete the index. After you're done, take the cluster out of maintenance mode. You will still need to apply the cluster bundle to remove the index definition. But that will technically require another rolling restart. However, a rolling restart of the cluster will maintain your SF / RF and users should not notice downtime. There is no way around the DM issue at this time. Splunk 6.4 should introduce the capability of replicated DM acceleration... ... View more

This will be available in Splunk 6.4. While we don't have an exact launch date, it will be happening soon.. Keep an eye out on the main page. ... View more