Getting Data In

Quarantine or peer removal

7aurelius
Loves-to-Learn

Hi,

Is there a way to remove or quarantine multiple search peers (indexers) at the same time? It's not practical enough for me to do it for on every search (one by one) head like the document states. 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

If you have shell access you can try this https://docs.splunk.com/index.php?title=Documentation:Splunk:DistSearch:Quarantineasearchpeer:6.2.0&...

Just loop over your nodes. 

r. Ismo

0 Karma

7aurelius
Loves-to-Learn

The indexers are not clustered. They are standalone.

0 Karma

thambisetty
Super Champion

removing number of indexers from your indexer cluster depends on your replication & search factor. for example if you have replication factor 2 and you would like to remove two indexers, there is a high chance of having two copies in those indexers. hence you can't remove indexers at same time. you can remove one by one.

————————————
If this helps, give a like below.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!