Splunk Cloud Platform

Use Edge Processors

Remove pipelines from Edge Processors

An Edge Processor acts on the data that it receives based on the data processing instructions defined in the associated pipelines. To disable specific data processing operations on your Edge Processor, remove the pipeline that defines those instructions.

Before removing a pipeline from an Edge Processor, check the other pipelines that are applied to the Edge Processor and verify that removing the pipeline won't cause unexpected data loss. Any data that is not processed by a pipeline is treated as unprocessed data, which is either routed to the default destination or dropped. As a best practice for preventing unwanted data loss, make sure to always have a default destination for your Edge Processors. See Set up an Edge Processor and Data pathway for more information.

Remove a pipeline from one or more Edge Processors

You can remove a pipeline from multiple Edge Processors at the same time.

  1. Navigate to the Pipelines page.
  2. In the row that lists the pipeline you want to remove from an Edge Processor, select the Actions icon (Image of the Actions icon) and then select Apply/remove.
  3. Deselect the check boxes beside the Edge Processors that you want to remove the pipeline from, and then select Save.
  4. It can take a few minutes for the Edge Processor service to finish removing your pipeline from an Edge Processor. During this time, all of the Edge Processors that use the pipeline enter the Pending status. To confirm that the process completed successfully, do the following:

    • Navigate to the Edge Processors page. Then, verify that the Instance health column for the affected Edge Processors shows that all instances are back in the Healthy status.
    • Navigate to the Pipelines page. Then, verify that the Applied column for the pipeline contains a The pipeline is applied icon (Image of the "applied pipeline" icon).

    You might need to refresh your browser to see the latest updates.

The Edge Processors that you removed the pipeline from no longer process and route data based on the instructions specified in that pipeline.

If you apply and remove the same pipeline from the same Edge Processor in quick succession, then the status icons might present conflicting information until one of the processes is completed.

Remove one or more pipelines from an Edge Processor

You can remove multiple pipelines at once from the same Edge Processor.

  1. Do one of the following:
    • On the Edge Processors page, in the row that lists the Edge Processor you want to remove pipelines from, select the Actions icon (Image of the Actions icon) and then select Apply/remove pipeline.
    • On the detailed view for a specific Edge Processor, select Actions > Apply/remove pipeline.
  2. Deselect the check boxes beside the pipelines that you want to remove from the Edge Processor, and then select Save.
  3. It can take a few minutes for the Edge Processor service to finish removing your pipeline from an Edge Processor. During this time, all of the Edge Processors that use the pipeline enter the Pending status.


    To confirm that the process completed successfully, do the following:

    • Navigate to the Edge Processors page. Then, verify that the Instance health column for the affected Edge Processors shows that all instances are back in the Healthy status.
    • Navigate to the Pipelines page. Then, verify that the Applied column for the pipeline contains a The pipeline is applied icon (Image of the "applied pipeline" icon).

    You might need to refresh your browser to see the latest updates.

The Edge Processor that you removed the pipelines from no longer process and route data based on the instructions specified in those pipelines.

If you apply and remove the same pipeline from the same Edge Processor in quick succession, then the status icons might present conflicting information until one of the processes is completed.

Last modified on 30 November, 2023
Apply pipelines to Edge Processors   Use templates to create pipelines for Edge Processors

This documentation applies to the following versions of Splunk Cloud Platform: 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403, 9.2.2406 (latest FedRAMP release), 9.3.2408


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters