Splunk Enterprise

Can't manually put peer into detention - valid boolean error

gerald_contrera
Path Finder

Hi All,

I am trying to put one of our Cluster indexer peers into manual detention and i get a boolean error:

CLI:
\bin>splunk edit cluster-config -manual_detention on_ports_enabled
Error:
key=manual_detention with val=on_ports_enabled is not a valid boolean value

I am running the above directly on the peer. I have not tried running from the CM.

I just want to stop using it for replication as it falls far short in matching the rest of the cluster in terms of specs and continuously causes bucket errors with the rest of the cluster.

I cant find any reference to this error or many people using the manual detention function.
Any help would be very much appreciated

Thanks

1 Solution

gerald_contrera
Path Finder

I found that if i do the CLI

splunk.exe edit cluster-config -manual_detention 1

This puts the peer into detention with all ports on.

Yes, the peer is visible in the dashboard and is now saying "ManualDetention-PortsEnabled "

When i re-read the error it states it requires a boolean value, so either 0 or 1

Perhaps the correct information in the documentation at

https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Peerdetention

should be

splunk edit cluster-config -auth : -manual_detention 1 [off|on|on_ports_enabled]

It seems to default to "on_ports_enabled" when using the boolean value of 1

I appear to have resolved my question, however i would still like to know how to specifically enable the two different "on" options for future reference.

View solution in original post

0 Karma

gerald_contrera
Path Finder

I found that if i do the CLI

splunk.exe edit cluster-config -manual_detention 1

This puts the peer into detention with all ports on.

Yes, the peer is visible in the dashboard and is now saying "ManualDetention-PortsEnabled "

When i re-read the error it states it requires a boolean value, so either 0 or 1

Perhaps the correct information in the documentation at

https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Peerdetention

should be

splunk edit cluster-config -auth : -manual_detention 1 [off|on|on_ports_enabled]

It seems to default to "on_ports_enabled" when using the boolean value of 1

I appear to have resolved my question, however i would still like to know how to specifically enable the two different "on" options for future reference.

0 Karma

iandrews_splunk
Splunk Employee
Splunk Employee

what version of splunk is this? also, does the peer show as "up" in the master dashboard?

0 Karma

woodcock
Esteemed Legend

I would open a support case.

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...