I am trying to put one of our Cluster indexer peers into manual detention and i get a boolean error:
\bin>splunk edit cluster-config -manual_detention on_ports_enabled
key=manual_detention with val=on_ports_enabled is not a valid boolean value
I am running the above directly on the peer. I have not tried running from the CM.
I just want to stop using it for replication as it falls far short in matching the rest of the cluster in terms of specs and continuously causes bucket errors with the rest of the cluster.
I cant find any reference to this error or many people using the manual detention function.
Any help would be very much appreciated
I found that if i do the CLI
splunk.exe edit cluster-config -manual_detention 1
This puts the peer into detention with all ports on.
Yes, the peer is visible in the dashboard and is now saying "ManualDetention-PortsEnabled "
When i re-read the error it states it requires a boolean value, so either 0 or 1
Perhaps the correct information in the documentation at
splunk edit cluster-config -auth : -manual_detention 1 [off|on|on_ports_enabled]
It seems to default to "on_ports_enabled" when using the boolean value of 1
I appear to have resolved my question, however i would still like to know how to specifically enable the two different "on" options for future reference.
View solution in original post
what version of splunk is this? also, does the peer show as "up" in the master dashboard?
I would open a support case.