Deployment Architecture

Is it possible to disable replication to specific peers in the cluster?

athoma31
Explorer

I've read on peers going into detention status due to storage capacity restrictions, however, is it possible to manually place a peer in detention status so that the data present on it remains searchable but it no longer receives replicated data from the rest of the cluster?

1 Solution

renjith_nair
SplunkTrust
SplunkTrust

In Splunk Version 6.3 and above Splunk has added capability to Put Cluster Peer in detention. Once Peer is in detention it will no longer get replicated buckets from other peer in cluster.

The command to put cluster peer in detention is
curl -k -u admin:changeme https://SLAVE:MGMT_PORT/services/cluster/slave/control/control/set_detention_override -d value=true -X POST

Ref : http://docs.splunk.com/Documentation/Splunk/6.3.0/RESTREF/RESTcluster

See the answer : https://answers.splunk.com/answers/331293/if-two-cluster-peers-in-an-indexer-cluster-are-get.html#an...

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

In Splunk Version 6.3 and above Splunk has added capability to Put Cluster Peer in detention. Once Peer is in detention it will no longer get replicated buckets from other peer in cluster.

The command to put cluster peer in detention is
curl -k -u admin:changeme https://SLAVE:MGMT_PORT/services/cluster/slave/control/control/set_detention_override -d value=true -X POST

Ref : http://docs.splunk.com/Documentation/Splunk/6.3.0/RESTREF/RESTcluster

See the answer : https://answers.splunk.com/answers/331293/if-two-cluster-peers-in-an-indexer-cluster-are-get.html#an...

Happy Splunking!

athoma31
Explorer

Is this a command that can be used prior to 6.3 (such as version 6.2.6)?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can remove the indexer/peer where you don't want replication from the indexer cluster and add that indexer as regular/non-clustered search peer so that it's searchable. See these links.

Remove a peer from cluster http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Removepeerfrommasterlist
Search in clustered and non-clustered peers http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Configureclusteredandnonclusteredsearch

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...