topic How to disable a search peer via the CLI or REST API call? in Getting Data In

How to disable a search peer via the CLI or REST API call?

tsunamii — Tue, 05 Apr 2016 22:26:13 GMT

Hi Splunkers,

Is there a way to disable a search peer via the CLI or an API call?

Specifically, I would like to set this param via CLI or REST API, and without having to restart splunk:

# distsearch.conf
disabled_servers = <comma separated list of servers>
* A list of configured but disabled search peers.

Thanks.

splunkIT — Thu, 07 Apr 2016 15:52:42 GMT

I have tested the following commands in my 6.3.3 search head, and appears to be working:

To enable search peer:

curl -ku admin https://<host>:<mPort>/servicesNS/-/search/search/distributed/peers/<search_peer_host>%3A<mPort>/enable -X POST

To disable search peer:

curl -ku admin https://<host>:<mPort>/servicesNS/-/search/search/distributed/peers/<search_peer_host>%3A<mPort>/disable -X POST