topic What parameters should I pass to this Splunk REST API endpoint to archive the same thing that 'splunk offline --enforce-counts' does? in Getting Data In

What parameters should I pass to this Splunk REST API endpoint to archive the same thing that 'splunk offline --enforce-counts' does?

rongshengfang — Wed, 14 Jan 2015 00:13:33 GMT

Does anybody know what parameters I should pass to the REST API endpoint /services/cluster/slave/control/control/decommission to archive the same thing that command 'splunk offline --enforce-counts' does?

Thanks!

Re: What parameters should I pass to this Splunk REST API endpoint to archive the same thing that 'splunk offline --enforce-counts' does?

jacobwilkins — Wed, 30 Nov 2016 16:56:56 GMT

Bumping this because I'd really like to know the answer.

Re: What parameters should I pass to this Splunk REST API endpoint to archive the same thing that 'splunk offline --enforce-counts' does?

jacobwilkins — Wed, 30 Nov 2016 17:05:20 GMT

Through some testing, it seems that enforce_counts=true might be the correct POST parameter.

It would be nice if someone from Splunk could confirm.

Re: What parameters should I pass to this Splunk REST API endpoint to archive the same thing that 'splunk offline --enforce-counts' does?

MuS — Tue, 26 Mar 2019 23:42:21 GMT

Greeting from the future,

according to the latest docs https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTcluster#cluster.2Fslave.2Fcontrol.2Fcontrol.2Fdecommission it is like this :

curl -k -u admin:pass https://indexer:8089/services/cluster/slave/control/control/decommission -X POST

cheers, MuS

Re: What parameters should I pass to this Splunk REST API endpoint to archive the same thing that 'splunk offline --enfo

melcher — Thu, 02 Jun 2022 23:00:56 GMT

I've tested and confirmed that when you add the enforce_counts=true to the api call like seen below, it will perform a full decommissioning of the host. Thank you for bringing it up!

curl -k -u admin:pass https://indexer:8089/services/cluster/slave/control/control/decommission -d enforce_counts=true -X POST