Splunk Enterprise

Taking off a peer which is already down from single site cluster

nawazns5038
Builder

Hi,

A peer was down recently because of some server issues and the buckets re balanced among themselves with the other servers.
I want to remove the peer from the indexer cluster as the the host cannot be used anymore.

And, Splunk is not running and cannot be run as one of the drives that hold the hot data got erased. There was no loss in the cluster as we are using the replication and search factors.

Could you please suggest a method or all the steps needed to remove the peer from a cluster safely.

Thanks,
N

0 Karma

adonio
Ultra Champion

hello there,

many answers here in the portal, example:
https://answers.splunk.com/answers/241511/steps-to-remove-a-cluster-member-permanently.html

read here in docs:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Removepeerfrommasterlist
http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Takeapeeroffline
read all the way through.

if the indexer is already down, run this command:
splunk offline --enforce-counts

hope it helps

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...