topic Re: Quarantine or peer removal in Getting Data In

Quarantine or peer removal

7aurelius — Tue, 22 Sep 2020 03:32:45 GMT

Hi,

Is there a way to remove or quarantine multiple search peers (indexers) at the same time? It's not practical enough for me to do it for on every search (one by one) head like the document states.

Re: Quarantine or peer removal

thambisetty — Tue, 22 Sep 2020 12:35:32 GMT

removing number of indexers from your indexer cluster depends on your replication & search factor. for example if you have replication factor 2 and you would like to remove two indexers, there is a high chance of having two copies in those indexers. hence you can't remove indexers at same time. you can remove one by one.

Re: Quarantine or peer removal

7aurelius — Tue, 22 Sep 2020 16:09:20 GMT

The indexers are not clustered. They are standalone.

Re: Quarantine or peer removal

isoutamo — Tue, 22 Sep 2020 16:12:46 GMT

If you have shell access you can try this https://docs.splunk.com/index.php?title=Documentation:Splunk:DistSearch:Quarantineasearchpeer:6.2.0&action=pdfbook&version=8.0.6&topic=1&product=Splunk

Just loop over your nodes.

r. Ismo