Remove closed search heads in our splunk cluster Or Master

[anil1432]

Hello EveryOne ,

Please Help Me Regarding How to Remove Splunk Search heads From Splunk Master Or Cluster

We Have Some Splunk Dedicated Search Heads  In Our Environment. Ex: 15 Search Heads . In That 7 Search Heads Are Down, Because The Users Are Stopped Using Splunk Search Heads. . So Now We Are Planning To Remove Those 7 search  heads from our Splunk Master . What Is Procedure . could Anyone Explain Me In Manual Way. It Would Be Great. .

Please Also Check One Screen Shot I Have Shared . Find Below , We Need to Remove These Search Heads.

Regards

[anil1432]

Hello @isoutamo  ,

Could You Please Provide me The Step By Step Document To Remove Search Heads From Splunk Master . It  Would Be Very Helpful To me please 

[isoutamo]

Hi

If it's still inSHC, then remove it from there: https://docs.splunk.com/Documentation/Splunk/8.2.3/DistSearch/Removeaclustermember

Remove "search peer" (your SHC member from MC/CM acting as MC): https://docs.splunk.com/Documentation/Splunk/8.2.3/DistSearch/Removeasearchpeer

Then update MC's inventory:

Settings -> MC -> General Setup -> Apply Changes

Then it should be ok.

r. Ismo

[venkatasri]

Hi @anil1432 

search heads must have been clustered to use this link. This has detailed steps, Master/Manager used in indexers world. Where as Search heads having captain. Captain doesn't play a role in removing the member as per steps above.

https://docs.splunk.com/Documentation/Splunk/8.2.2/DistSearch/Removeaclustermember

--

An upvote would be appreciated if this reply helps!

[isoutamo]

Hi

If you refer Monitoring Console as a cluster master, then just remove those indexer peers from Distributed search and then apply new config on MC's settings pages.

r. Ismo