Splunk Enterprise

How to delete a dead Splunk Indexer

ReginaP
Explorer

I have an indexer RHEL7 server that is DEAD.  I have no way of getting into it to run any commands.  I was able to remove it from the Index Cluster using: 

splunk remove cluster-peers -peers <guid>

 However, it is still in the Monitoring Console as an instance unreachable.  How can I fully remove it?

Labels (1)
0 Karma

ReginaP
Explorer

This worked: 

Settings > Monitoring Console > Settings > General Setup > Apply Changes

isoutamo
SplunkTrust
SplunkTrust

Hi

login MC node.

you need to go MC -> Settings -> General 

Then remove/disable/apply that page.

If this doesn’t help, then go first Settings-> Distributed Search -> peers (or something similar). Remove it from there if it’s still there. Then remove it again from MC side.

 

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...