topic Re: How can we stop an indexer from indexer-master? in Getting Data In

How can we stop an indexer from indexer-master?

saurabh009 — Tue, 14 May 2019 19:52:07 GMT

Hi,
We have situation where we can't login to one of the single indexer in the cluster and we need to stop it for maintenance purpose.
Is it possible to stop single indexer from indexer-master ?

Re: How can we stop an indexer from indexer-master?

aromanauskas — Tue, 14 May 2019 20:11:16 GMT

If you are unable to login to the indexer and shutdown the entire splunk process. Your next best option is to put the indexer in detention.

From the master:

splunk edit cluster-config -auth : -peers -manual_detention on

https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Peerdetention

Re: How can we stop an indexer from indexer-master?

dxu_splunk — Wed, 15 May 2019 00:24:17 GMT

we can offline an indexer through curl. dont forget to set the master in maintenance-mode so it won't create excess buckets for the temporarily-down-indexer

curl -k https://PEER:MGMT_PORT/services/cluster/slave/control/control/decommission -X POST -u admin:changeme