How can we stop an indexer from indexer-master?

[saurabh009]

Hi,
We have situation where we can't login to one of the single indexer in the cluster and we need to stop it for maintenance purpose.
Is it possible to stop single indexer from indexer-master ?

[dxu_splunk]

we can offline an indexer through curl. dont forget to set the master in maintenance-mode so it won't create excess buckets for the temporarily-down-indexer

curl -k https://PEER:MGMT_PORT/services/cluster/slave/control/control/decommission -X POST -u admin:changeme

[aromanauskas]

If you are unable to login to the indexer and shutdown the entire splunk process. Your next best option is to put the indexer in detention.

From the master:

splunk edit cluster-config -auth : -peers -manual_detention on

https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Peerdetention