Deployment Architecture

How to permanently decommission the Search Head?

muez
Explorer

I have 10 SH in my environment.(THEY ARE NOT under SEARCH HEAD CLUSTERING) but they are under my master's "list of peers"
And I want to permanently decommission couple of them.

What are the steps to be taken care of.
If you can share the splunk doc link, it would be useful

Thanks!

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Search Heads can be removed / shut off without any technical concerns. The biggest concern would be any knowledge objects ( dashboards, alerts, saved searches, lookups, etc) that are actively used on those search heads. If you don't need to use these, just shut the instance down.

If these are Search Peers also, meaning you have indexed data on them and actively search that data, you need to follow the remove a search peer instructions : https://docs.splunk.com/Documentation/Splunk/8.0.1/DistSearch/Removeasearchpeer

0 Karma

muez
Explorer

WE DO HAVE BIGGEST CONCERN ABOUT HAVING KNOWLEDGE OBJECTS ON THEM. WHAT TO DO?

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...