I can't change the file, or I might be doing something wrong.
I am editing distsearch.conf file
I delete the contents of servers 184.108.40.206, 220.127.116.11
disabled = 0
servers = https://18.104.22.168:8089,https://22.214.171.124:8089,https://126.96.36.199:8089,https://188.8.131.52:8089
everything comes back.
I'm trying to delete via web. also does not apply. getting this error
"Error occurred attempting to remove 184.108.40.206:8089: Failed to proxy search-server command request to Captain. Reason : ERROR: There is no search peer with a URI of https://220.127.116.11:8089. Either the URI you entered is incorrect or the search peer has already been removed.. "
there is network access. everything works correctly.
But **bleep** it I can't delete it from the file
Maybe someone can tell me what I'm doing wrong. and is there any provision.
It sounds like you're editing the file directly on an SHC node. That's the wrong way to manage a SHC. Edit the file on your SHC Deployer and apply the shbundle.
First, create an app in the $SPLUNK_HOME/etc/shcluster directory of your SHC Deployer. The app will contain a distsearch.conf file. Push the app to the cluster using the apply shcluster-bundle command.
Next, you need to delete the $SPLUNK_HOME/etc/system/local/distsearch.conf file from the SHC nodes. I think the most effective way to do that is to stop all SHC members, delete the file, then restart the cluster. Perhaps someone else will have a better answer that doesn't require an outage.
deleted the file along the path /opt/splunk/etc/system/local/distsearch.conf
on all sh
created an application on the deployer server and created the apps/local/distsearch.conf file there with all the parameters
push with the command
/opt/splunk/bin/splunk apply shcluster-bundle --answer-yes -target https://ip:8089 -preserve-lookups true
and along the path /opt/splunk/etc/system/local/distsearch.conf a new file was created and there was only a parameter
[root@splunk-sh local]# cat distsearch.conf
servers = https://18.104.22.168:8089, https://22.214.171.124:8089, https://126.96.36.199:8089, https://188.8.131.52:8089
he created it again