Splunk Enterprise

Is there a rest endpoint to take a peer offline temporarily?

vtalanki
Path Finder

Hi,

Is there a rest endpoint to take a peer offline temporarily?

I see one for decommissioning - 

 

 

curl -k -u admin:pass https://indexer:8089/services/cluster/slave/control/control/decommission

 

 

But seem like this is for permanent offline.

We are looking to take a peer offline temporarily..

Labels (1)
0 Karma

melcher
Explorer

@vtalanki I know this is a bit older but for you or anyone that is coming from Google search, the decommission API endpoint actually enacts the same as a splunk offline command. This means that it will take the indexer down temporarily and then later decommission the indexer should it not come back up in the allowed restart time. The same as what's found in the documentation: Take a peer offline - Splunk Documentation

If you want to take down host permanently, you need to add a -d enforce_counts=true parameter to your curl command. This does the same as a splunk offline --enforce-counts command.

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...