Getting Data In

How can we stop an indexer from indexer-master?

Path Finder

Hi,
We have situation where we can't login to one of the single indexer in the cluster and we need to stop it for maintenance purpose.
Is it possible to stop single indexer from indexer-master ?

0 Karma

Splunk Employee
Splunk Employee

we can offline an indexer through curl. dont forget to set the master in maintenance-mode so it won't create excess buckets for the temporarily-down-indexer

curl -k https://PEER:MGMT_PORT/services/cluster/slave/control/control/decommission -X POST -u admin:changeme

Path Finder

If you are unable to login to the indexer and shutdown the entire splunk process. Your next best option is to put the indexer in detention.

From the master:

splunk edit cluster-config -auth : -peers -manual_detention on

https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Peerdetention

0 Karma