topic Re: Search Head Cluster member removal in Deployment Architecture

Search Head Cluster member removal

coreyf311 — Thu, 12 Apr 2018 11:20:00 GMT

How can I remove a search head cluster member when that member is down? Power outage at a location took down two of our search head cluster members for a week. I cant push bundles from the Deployer while these two are down. How can I remove them from the cluster while they are down so that the rest of the cluster can operate as intended?

Re: Search Head Cluster member removal

p_gurav — Thu, 12 Apr 2018 12:26:39 GMT

You can use remove member command. Below docs:
https://docs.splunk.com/Documentation/Splunk/7.0.3/DistSearch/Removeaclustermember

Re: Search Head Cluster member removal

coreyf311 — Thu, 12 Apr 2018 14:43:48 GMT

does not work because the member i am trying to remove is not available. its down due to a power outage in the DC it is hosted.

Re: Search Head Cluster member removal

somesoni2 — Thu, 12 Apr 2018 16:18:48 GMT

I'm guessing you can't deploy because you lost majority for captain election. In cases like this, you'd assign one of available node as static captain so that SHC can function. See this for more info on how to do it.

http://docs.splunk.com/Documentation/Splunk/7.0.3/DistSearch/Staticcaptain

Re: Search Head Cluster member removal

coreyf311 — Fri, 13 Apr 2018 11:26:26 GMT

we have majority. The SHC in total is 6 SH's. So we currently have 4 SH's up and available and 2 that are down and unavailable.

Re: Search Head Cluster member removal

def65483 — Wed, 07 Aug 2019 15:37:58 GMT

How is this the accepted answer? It does not explain at all the process to remove an already downed member from a cluster. If I missed it, please explain.