topic Re: How to disable one search peer in cluster? in Splunk Search

How to disable one search peer in cluster?

TISKAR — Sat, 22 Jun 2019 21:43:03 GMT

Hello, Splunkers:

I have a Cluster that contains 3 indexers and one search head.

I want the search head to communicate with two indexers, is there a way to do that (disable communication with the third)?

I tried to disable and delete using Settings/ Distributed search / Search peers =====> But it displays the error

Error occurred attempting to disable IP:8089: Can not disable peer = https: //ip: 8089. This peer is a part of a cluster.

Can You help, please?

Regards 😉

Re: How to disable one search peer in cluster?

VatsalJagani — Sun, 23 Jun 2019 03:23:02 GMT

Hello @TISKAR,

You have added that search head as part of the cluster as a search head node. Instead, if you want limited access to search peers, you can just use distributed search and manually add search peers' IPs.
But, just for the clarification, if you don't know the configuration of the cluster properly then this might give you incomplete data.

Hope this helps!!!

Re: How to disable one search peer in cluster?

jnudell_2 — Mon, 24 Jun 2019 19:19:44 GMT

Hi @TISKAR ,

Why would you want to do this? If you excluded one search peer from your search head, you would always receive incomplete search results.

Re: How to disable one search peer in cluster?

woodcock — Mon, 24 Jun 2019 19:41:54 GMT

You are using the indexer discovery feature. Disabled this feature and peer manually to only the indexers that you desire to search. Beware that your request makes no sense to me and is guaranteed to give you incomplete/partial search results.