Deployment Architecture

How remove old index=main data after an indexer cluster migration?

kwanx
Explorer

Hello!

Prior to Jan 2015, I had a single Server Splunk Environment; in Jan 2015 I migrated to a 4 node environment consisting of Search head (this server was the single splunk platform prior to Jan 2015), Master/Slave/Slave(new servers installed); This new cluster has worked great since then.

Now I wish to clean up 300 GB of data on the now Search Head in main index of /opt/splunk/var/lib/splunk/defaultdb/db. This data was from when the now search head server was the sole provider of all Splunk functions prior to Jan 2015; the data has not been touched since Jan 2015. (as verified in GUI as well as CLI on server)

When I try to disable main from GUI I get:

"Error occurred attempting to disable main: In handler 'indexes': cannot disable idx=main, is internal."

Please assist on how I can remove this old /opt/splunk/var/lib/splunk/defaultdb/db data from my search head without damaging my new data that is on the 2 Slave nodes.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can stop the search head and move the buckets (db_epoch1_epoch2_id directories) inside /opt/splunk/var/lib/splunk/defaultdb/db to a different place on that machine, then start the search head again. It'll start normally, all your data will still be on the cluster peers, and once verified you can properly delete the buckets.

0 Karma

kwanx
Explorer

Thank you martin - I will give that a try and let it ride a day before deleting old data, then report back.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...