topic Re: How to remove an indexer from the distributed management console? in Getting Data In

How to remove an indexer from the distributed management console?

a212830 — Fri, 20 May 2016 17:35:23 GMT

Hi,

I removed some indexers from Splunk, using the offline command, but they are all still showing up in my distributed management console, and listed as "unreachable". How do I remove them from the DMC?

Re: How to remove an indexer from the distributed management console?

somesoni2 — Fri, 20 May 2016 18:05:03 GMT

You can just remove them from Settings / Distributed search / Search peers

Re: How to remove an indexer from the distributed management console?

a212830 — Sat, 21 May 2016 02:21:14 GMT

Did that, restarted DMC - didn't make a difference.

Re: How to remove an indexer from the distributed management console?

jkat54 — Sat, 21 May 2016 12:49:08 GMT

See if this works:

Open the DMC, click on menu called "settings" -> general setup -> edit next to the indexer -> disable monitoring

Re: How to remove an indexer from the distributed management console?

a212830 — Sat, 21 May 2016 13:50:58 GMT

It gets more interesting...

The "Overview" page shows 18 indexers and 12 unreachable (the 12 that I decommed via "offline"). The general setup page does not show them at all. I went into the "managementconsole_overview" view, and it lists the following:

<?xml version="1.0"?>
<view template="pages/app.html" type="html">
    <label>Overview</label>
</view>

I looked for that html page under ../etc, but found nothing. Thoughts?

Re: How to remove an indexer from the distributed management console?

mosman_splunk — Sat, 21 May 2016 14:23:13 GMT

you need to disable it as search peer Settings / Distributed search / Search peers

then you need to remove it from dmc settings" -> general setup -> edit next to the indexer -> disable monitoring

Re: How to remove an indexer from the distributed management console?

a212830 — Sat, 21 May 2016 14:29:10 GMT

See above - did all that...

Re: How to remove an indexer from the distributed management console?

fabiocaldas — Mon, 11 Jul 2016 23:07:02 GMT

I did what @somesoni2 and @jkat54 recommended but node is still "Unreachable"

Re: How to remove an indexer from the distributed management console?

fabiocaldas — Mon, 11 Jul 2016 23:07:33 GMT

I also did but it doesn't solved the problem

Re: How to remove an indexer from the distributed management console?

fabiocaldas — Mon, 11 Jul 2016 23:25:05 GMT

I had the same problem but runnign all steps again it worked

1 - Open the DMC -> Settings -> General Setup -> Edit next to the indexer -> Disable monitoring
2 - Restart Master server
3 - Apply Changes on DMC -> Settings -> General Setup

Re: How to remove an indexer from the distributed management console?

xtrjx — Tue, 31 Jan 2017 14:40:39 GMT

I also had the same problem but the indexer I took down did not show at all in the DMC settings so I could not disable it. I just clicked the "Apply Changes" button anyway and that removed the indexer from the other DMC views.

Re: How to remove an indexer from the distributed management console?

lgely — Tue, 29 Sep 2020 15:08:59 GMT

Hi,

modify the assets.csv file on the instance where is installed DMC

file locate = etc/apps/splunk_management_console/lookups/assets.csv

You need to update this file with the new/good informations (in my case new SH, change name/IP and ID if different)

I just :
modify my "distsearch.conf" on DMC instance
modify the "assets.csv" on DMC instance
add the trusted.pem on my new SH
restart my new SH and my DMC instance
and all is OK

Hope help you

Re: How to remove an indexer from the distributed management console?

CaptainHook — Tue, 27 Feb 2018 21:34:15 GMT

After you click on "Apply Changes" that did work for me also.

Re: How to remove an indexer from the distributed management console?

sherm77 — Mon, 02 Jul 2018 20:20:15 GMT

This was the only thing that worked for me, at least editing the assets.csv. A decomm'd indexer wouldn't go away from the monitoring console, editing the assets.csv took the indexer out of the monitoring console (v6.6.3).

Re: How to remove an indexer from the distributed management console?

DEAD_BEEF — Wed, 11 Jul 2018 20:34:17 GMT

Go to Settings > Monitoring Console > Settings > General Setup > "Apply Changes"

For some reason this fixed my issue as well despite making no other changes.

Re: How to remove an indexer from the distributed management console?

amiller100 — Fri, 06 Sep 2019 14:29:33 GMT

I had to do the same as above. Within the Monitoring Console I performed the "Apply Changes" and that removed the decommissioned indexer from view.

Re: How to remove an indexer from the distributed management console?

greich — Mon, 28 Oct 2019 07:52:50 GMT

whether you edit in UI or the conf files, it does not always update the kvstore until you "Apply changes"

Re: How to remove an indexer from the distributed management console?

Gregski11 — Mon, 12 Jul 2021 17:49:23 GMT

this worked for us, after days of struggle, thank you so much

Re: How to remove an indexer from the distributed management console?

isoutamo — Tue, 13 Jul 2021 21:26:13 GMT

This will update those lookups which are used for MC’s different views. It is always needed after you have done those changes on your infrastructure.