How to undo integration of SHC with multisite indexer cluster?

[gkas99]

As part of deployment rollback, how do we undo integrating SHC with multisite indexer cluster done with following command from this instruction - https://docs.splunk.com/Documentation/Splunk/9.0.1/DistSearch/SHCandindexercluster#Configure_members ?

splunk edit cluster-config -mode searchhead -site site0 -manager_uri https://10.152.31.202:8089 -secret newsecret123 -auth login:password 

splunk restart

[chaker · Accepted solution]

Hi @gkas99 

Do you want to revert to single site or distributed search?

All config for SHC is found under the [clustering] stanza in server.conf on each SH. You could open server.conf, remove the config for clustering and restart. This will give you a blank slate to configre the SH however you like.

If you want to go back to single site, the command above you provided will work, just remove the -site reference.