Deployment Architecture

How do I remove a search head from an Indexer Cluster?

lguinn2
Legend

I have been building an indexer cluster. As part of my testing, I created several search heads and added them to the cluster.
Then I killed some of the search heads.

The search heads still appear on the Cluster Master's dashboard under the "Search Heads" tab. Of course, the search heads I want to remove are listed as "Down"

How do I get rid of these?

1 Solution

esix_splunk
Splunk Employee
Splunk Employee

This is correct. Once you restart the Cluster Master node, the removed SH / IDX Peers will be removed from the display.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

This is correct. Once you restart the Cluster Master node, the removed SH / IDX Peers will be removed from the display.

hemendralodhi
Contributor

Hi, I have seen this in the past with our deployment and even after bringing down SH they appear in CM. I restarted CM and all SH which were marked down got removed from the list.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...