Splunk Search

How to disable one search peer in cluster?

TISKAR
Builder

Hello, Splunkers:

I have a Cluster that contains 3 indexers and one search head.

I want the search head to communicate with two indexers, is there a way to do that (disable communication with the third)?

I tried to disable and delete using Settings/ Distributed search / Search peers =====> But it displays the error

Error occurred attempting to disable IP:8089: Can not disable peer = https: //ip: 8089. This peer is a part of a cluster.

Can You help, please?

Regards 😉

0 Karma

woodcock
Esteemed Legend

You are using the indexer discovery feature. Disabled this feature and peer manually to only the indexers that you desire to search. Beware that your request makes no sense to me and is guaranteed to give you incomplete/partial search results.

0 Karma

jnudell_2
Builder

Hi @TISKAR ,

Why would you want to do this? If you excluded one search peer from your search head, you would always receive incomplete search results.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hello @TISKAR,

You have added that search head as part of the cluster as a search head node. Instead, if you want limited access to search peers, you can just use distributed search and manually add search peers' IPs.
But, just for the clarification, if you don't know the configuration of the cluster properly then this might give you incomplete data.

Hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...