Deployment Architecture

How to disable an index on a Cluster Master using REST API

dhernandez
New Member

Hello,

I'm working with a Splunk cluster which has two slave peers and I need to disable an index on the Cluster Master using the REST API. I've tried the usual endpoint (/servicesNS/nobody/{app}/configs/conf-indexes/{index}) as this doc says (https://docs.splunk.com/Documentation/Splunk/8.0.0/RESTREF/RESTconf#configs.2Fconf-.7Bfile.7D.2F.7Bs... ), but it doesn't seem to work on the Cluster Master.

Can someone please provide me with the specific REST API endpoint I should use to disable an index on the Cluster Master? I have read the documentation https://docs.splunk.com/Documentation/Splunk/8.0.0/RESTREF/RESTcluster but there is no reference to what I need.

Thank you in advance for your assistance

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

One problem is the CM does not manage indexes.  It manages indexers (search peers), buckets, and apps.  To disable an index you need to modify indexes.conf in an app in $SPLUNK_HOME/etc/cluster/apps and then apply the cluster bundle.

There is a REST endpoint for applying the bundle (cluster/manager/control/default/apply).  There also is a REST endpoint for installing and updating apps (apps/local), but it can't touch the etc/cluster/apps directory.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...