Deployment Architecture

Quarantine a search peer but it still shows up in search


Hi Splunk gurus,

I have a deployment like below:

3 nodes as Search Head cluster, 3 nodes as Search peers and 1 manager node of this indexer cluster. The SHC is connecting to the indexer cluster via

When I quarantined one of the indexers(search peers), it did say that one of the indexers is excluded,  this only showed up in the web page of manager node (which is working as a search head as well) but not in the page of any other search head, is this normal?


Labels (2)
0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...