topic Re: How to reset corrupt peer (indexer) from cluster? in Deployment Architecture

How to reset corrupt peer (indexer) from cluster?

splunkreal — Mon, 17 Oct 2022 14:35:34 GMT

Hello,

how to remove and clean corrupt peer (indexer) from cluster?

Should we stop it then after hardware maintenance delete all indexes data directories then start it again to resync whole data from other peers?

Thanks!

Re: How to reset corrupt peer (indexer) from cluster?

isoutamo — Mon, 17 Oct 2022 15:11:38 GMT

what you are meaning when you are saying that peer is corrupted?

Basically just add one node then remove old one if possible. Of course you can do it in another order too, but then you need more free spaces on current nodes.

Here is one (of many) old answer for this https://community.splunk.com/t5/Deployment-Architecture/Swap-indexers-from-indexer-cluster-with-new-peers/m-p/510403

r. Ismo

Re: How to reset corrupt peer (indexer) from cluster?

splunkreal — Mon, 17 Oct 2022 15:33:38 GMT

Hi @isoutamo if hard disks are corrupted for instance and need to remove all data then reset Splunk.

Re: How to reset corrupt peer (indexer) from cluster?

isoutamo — Mon, 17 Oct 2022 16:19:12 GMT

Then the easiest way it just add a new peer (if you have spare instance to take into use) and then remove old one. If you haven't a space node then just remove it first, fix disks and add it back as a new clean installation (remove splunk from it first!).

Re: How to reset corrupt peer (indexer) from cluster?

splunkreal — Tue, 18 Oct 2022 07:21:40 GMT

OK so this requires to reinstall Splunk then. Thanks a lot!