Deployment Architecture

Quarantine a search peer but it still shows up in search


Hi Splunk gurus,

I have a deployment like below:

3 nodes as Search Head cluster, 3 nodes as Search peers and 1 manager node of this indexer cluster. The SHC is connecting to the indexer cluster via

When I quarantined one of the indexers(search peers), it did say that one of the indexers is excluded,  this only showed up in the web page of manager node (which is working as a search head as well) but not in the page of any other search head, is this normal?


Labels (2)
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...