Getting Data In

Deleting an index in a distributed Splunk deployment

danielsofoulis
Path Finder

I would like to delete an index in Splunk using the following command.

splunk remove index

Just wondering where I should run this command? e.g. only on the Cluster Master (CM)? or on the indexers and CM?

I'm aware that data which is pointed to this index will be lost, any other risks I should be aware of?

0 Karma

jkat54
SplunkTrust
SplunkTrust

In a distributed peer/indexer cluster you remove the index from /opt/splunk/etc/master-apps/_cluster/local/indexes.conf OR /opt/splunk/etc/master-apps/YourIndexApp/(local|default)/indexes.conf on the cluster master and then push the cluster configuration bundle from the cluster master.

You should read this first:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Managecommonconfigurations

then this:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Configurethepeerindexes

danielsofoulis
Path Finder

Does this method of deleting indexes only remove the index from searching, but the data in that index is still stored on the servers? is that correct?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Yes that is correct, it leaves the index on the disk still consuming disk space but stops any additional events from being written to the index and stops allowing it to be searched. To remove the files you have to log into each indexer and remove the index under /opt/splunk/var/lib/splunk/ (I believe that's the path, usually get it mixed up but /opt/splunk/var/lib/ is the root dir for sure).

jkat54
SplunkTrust
SplunkTrust

The path the old data will be stored in will depend on the home data path and cold data path settings that were in indexes.conf.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...