Hello to all,
following problem make some trouble for me, hope u can help.
In a Search-Head-Cluster all Peers have under "splunk/etc/system/local" a distsearch.conf.
There is a Stanza which i want to delete, but after a restart it suddenly appears again.
What i tried was...
- delete Stanza on every peer
- After delete Stanza on every instance restart the cluster (splunk rolling-restart)
- Check deployer for apps
After this, the Stanza appeard again.
Example:
I want this:
[distributedSearch]
servers = https://server1:8089, https://server2:8089, https://server3:8089
look like this:
[distributedSearch]
servers = https://server1:8089, https://server3:8089
On my deployer is no app which will affect the distsearch.conf in my SHC.
Normaly an app would go under /splunk/etc/apps.
I Just inherited the Environment and not 100% sure about every connection.
Thank you for your help/comments
-- Hope this helps
I checked some connections today and i found more interesting things:
Server 1 is a Cluster Master ; Server 2 was a Standalone indexer (Not Multiside) ; Server 3 (Still active is a Standalone Indexer too, not Multiside)
I can run searches on the Cluster and on server 3.
whatever, it is not possible to delete server 2 from the Stanza of Distsearch.
@anilchaithu thank you for your help.
I will try this today and report the result.
-- Hope this helps