Splunk Enterprise

Can't manually put peer into detention - valid boolean error

gerald_contrera
Path Finder

Hi All,

I am trying to put one of our Cluster indexer peers into manual detention and i get a boolean error:

CLI:
\bin>splunk edit cluster-config -manual_detention on_ports_enabled
Error:
key=manual_detention with val=on_ports_enabled is not a valid boolean value

I am running the above directly on the peer. I have not tried running from the CM.

I just want to stop using it for replication as it falls far short in matching the rest of the cluster in terms of specs and continuously causes bucket errors with the rest of the cluster.

I cant find any reference to this error or many people using the manual detention function.
Any help would be very much appreciated

Thanks

1 Solution

gerald_contrera
Path Finder

I found that if i do the CLI

splunk.exe edit cluster-config -manual_detention 1

This puts the peer into detention with all ports on.

Yes, the peer is visible in the dashboard and is now saying "ManualDetention-PortsEnabled "

When i re-read the error it states it requires a boolean value, so either 0 or 1

Perhaps the correct information in the documentation at

https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Peerdetention

should be

splunk edit cluster-config -auth : -manual_detention 1 [off|on|on_ports_enabled]

It seems to default to "on_ports_enabled" when using the boolean value of 1

I appear to have resolved my question, however i would still like to know how to specifically enable the two different "on" options for future reference.

View solution in original post

0 Karma

gerald_contrera
Path Finder

I found that if i do the CLI

splunk.exe edit cluster-config -manual_detention 1

This puts the peer into detention with all ports on.

Yes, the peer is visible in the dashboard and is now saying "ManualDetention-PortsEnabled "

When i re-read the error it states it requires a boolean value, so either 0 or 1

Perhaps the correct information in the documentation at

https://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Peerdetention

should be

splunk edit cluster-config -auth : -manual_detention 1 [off|on|on_ports_enabled]

It seems to default to "on_ports_enabled" when using the boolean value of 1

I appear to have resolved my question, however i would still like to know how to specifically enable the two different "on" options for future reference.

0 Karma

iandrews_splunk
Splunk Employee
Splunk Employee

what version of splunk is this? also, does the peer show as "up" in the master dashboard?

0 Karma

woodcock
Esteemed Legend

I would open a support case.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...