topic Re: How to delete a dead Splunk Indexer in Splunk Enterprise

How to delete a dead Splunk Indexer

ReginaP — Fri, 18 Aug 2023 18:59:15 GMT

I have an indexer RHEL7 server that is DEAD. I have no way of getting into it to run any commands. I was able to remove it from the Index Cluster using:

splunk remove cluster-peers -peers <guid>

However, it is still in the Monitoring Console as an instance unreachable. How can I fully remove it?

Re: How to delete a dead Splunk Indexer

isoutamo — Fri, 18 Aug 2023 20:22:41 GMT

you need to go MC -> Settings -> General

Then remove/disable/apply that page.

If this doesn’t help, then go first Settings-> Distributed Search -> peers (or something similar). Remove it from there if it’s still there. Then remove it again from MC side.

Re: How to delete a dead Splunk Indexer

ReginaP — Fri, 18 Aug 2023 20:27:58 GMT

This worked:

Settings > Monitoring Console > Settings > General Setup > Apply Changes