Deployment Architecture

Unable to remove Search Peer from Search Head

cburgman
Path Finder

Just recently enabled HTTPs in my environment. I was able to remove and re add search peers to 2 other search heads with no issues. However, I have one that is giving me issues. When I attempt to remove a search peer i am getting:

Error occurred attempting to remove 10.x.x.x:8089: In handler 'distsearch-peer': Cannot remove peer=10.x.x.x:8089. This peer is a part of a cluster.

Tried from GUI and CLI. Both are giving the same error. Any ideas or troubleshooting suggestions?

0 Karma
1 Solution

masonmorales
Influencer

Clustered search peers have to be removed at the cluster's master node. Take a look at: https://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Removepeerfrommasterlist

Explanation: When a search head is connected to an indexer cluster, it receives its distributed peer list from the master node.

View solution in original post

0 Karma

masonmorales
Influencer

Clustered search peers have to be removed at the cluster's master node. Take a look at: https://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Removepeerfrommasterlist

Explanation: When a search head is connected to an indexer cluster, it receives its distributed peer list from the master node.

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...