Getting Data In

Quarantine or peer removal

7aurelius
Loves-to-Learn

Hi,

Is there a way to remove or quarantine multiple search peers (indexers) at the same time? It's not practical enough for me to do it for on every search (one by one) head like the document states. 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

If you have shell access you can try this https://docs.splunk.com/index.php?title=Documentation:Splunk:DistSearch:Quarantineasearchpeer:6.2.0&...

Just loop over your nodes. 

r. Ismo

0 Karma

7aurelius
Loves-to-Learn

The indexers are not clustered. They are standalone.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

removing number of indexers from your indexer cluster depends on your replication & search factor. for example if you have replication factor 2 and you would like to remove two indexers, there is a high chance of having two copies in those indexers. hence you can't remove indexers at same time. you can remove one by one.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...