Getting Data In

What parameters should I pass to this Splunk REST API endpoint to archive the same thing that 'splunk offline --enforce-counts' does?

rongshengfang
Explorer

Does anybody know what parameters I should pass to the REST API endpoint /services/cluster/slave/control/control/decommission to archive the same thing that command 'splunk offline --enforce-counts' does?

Thanks!

MuS
SplunkTrust
SplunkTrust

Greeting from the future,

according to the latest docs https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTcluster#cluster.2Fslave.2Fcontrol.2F... it is like this :

curl -k -u admin:pass https://indexer:8089/services/cluster/slave/control/control/decommission -X POST

cheers, MuS

0 Karma

jacobwilkins
Communicator

Through some testing, it seems that enforce_counts=true might be the correct POST parameter.

It would be nice if someone from Splunk could confirm.

melcher
Explorer

I've tested and confirmed that when you add the enforce_counts=true to the api call like seen below, it will perform a full decommissioning of the host. Thank you for bringing it up!

 

curl -k -u admin:pass https://indexer:8089/services/cluster/slave/control/control/decommission -d enforce_counts=true -X POST

 

 

0 Karma

jacobwilkins
Communicator

Bumping this because I'd really like to know the answer.

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...