How to reset corrupt peer (indexer) from cluster?

[splunkreal]

Hello,

how to remove and clean corrupt peer (indexer) from cluster?

Should we stop it then after hardware maintenance delete all indexes data directories then start it again to resync whole data from other peers?

Thanks!

[splunkreal]

Hi @isoutamo if hard disks are corrupted for instance and need to remove all data then reset Splunk.

[isoutamo · Accepted solution]

Then the easiest way it just add a new peer (if you have spare instance to take into use) and then remove old one. If you haven't a space node then just remove it first, fix disks and add it back as a new clean installation (remove splunk from it first!).

[splunkreal]

OK so this requires to reinstall Splunk then. Thanks a lot!

[isoutamo]

Hi

what you are meaning when you are saying that peer is corrupted?

Basically just add one node then remove old one if possible. Of course you can do it in another order too, but then you need more free spaces on current nodes.

Here is one (of many) old answer for this https://community.splunk.com/t5/Deployment-Architecture/Swap-indexers-from-indexer-cluster-with-new-...

r. Ismo