Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Is it possible to disable replication to specific ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've read on peers going into detention status due to storage capacity restrictions, however, is it possible to manually place a peer in detention status so that the data present on it remains searchable but it no longer receives replicated data from the rest of the cluster?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In Splunk Version 6.3 and above Splunk has added capability to Put Cluster Peer in detention. Once Peer is in detention it will no longer get replicated buckets from other peer in cluster.
The command to put cluster peer in detention is
curl -k -u admin:changeme https://SLAVE:MGMT_PORT/services/cluster/slave/control/control/set_detention_override -d value=true -X POST
Ref : http://docs.splunk.com/Documentation/Splunk/6.3.0/RESTREF/RESTcluster
See the answer : https://answers.splunk.com/answers/331293/if-two-cluster-peers-in-an-indexer-cluster-are-get.html#an...
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In Splunk Version 6.3 and above Splunk has added capability to Put Cluster Peer in detention. Once Peer is in detention it will no longer get replicated buckets from other peer in cluster.
The command to put cluster peer in detention is
curl -k -u admin:changeme https://SLAVE:MGMT_PORT/services/cluster/slave/control/control/set_detention_override -d value=true -X POST
Ref : http://docs.splunk.com/Documentation/Splunk/6.3.0/RESTREF/RESTcluster
See the answer : https://answers.splunk.com/answers/331293/if-two-cluster-peers-in-an-indexer-cluster-are-get.html#an...
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is this a command that can be used prior to 6.3 (such as version 6.2.6)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can remove the indexer/peer where you don't want replication from the indexer cluster and add that indexer as regular/non-clustered search peer so that it's searchable. See these links.
Remove a peer from cluster http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Removepeerfrommasterlist
Search in clustered and non-clustered peers http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Configureclusteredandnonclusteredsearch
Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...
Splunk Observability for AI
🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler
