EDR: How to unload a core from Solr

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Unload a warm core from Solr 

Environment

• EDR Server: All versions (Formerly CB Response)

Resolution

1. Determine which core is to be unloaded and record the core name (<CORE_NAME>)
2. Run

curl "http://localhost:8080/solr/admin/cores?action=UNLOAD&core=​​<CORE_NAME>"

 

Additional Information

• Cores are located under /var/cb/data/solr*/cbevents
• The core name will match the name of the folder
  • Ex. cbevents_2020_08_03_0331
• Unloaded cores will remain in the directory, but will no longer load when Solr starts