how to remove an indexer from an indexer cluster

[xsstest]

dear everyone.

I hava an indexer cluster. It's have. It has eight indexers and one master node.

now . I want to remove an indexer (peer)? What should I do?

I've tried the following steps, but I don't know if it's right

first : running splunk stop on that peer
second : running splunk remove cluster-peers -peers <guid>

but. When I start the indexer again, it appears again in the cluster

[s2_splunk · Accepted solution]

Recommended read 🙂

[xsstest]

Each respondent asks me to look at different documents. What is the correct answer?

[s2_splunk]

Well, have you read any of it? 😉

If you want to permanently decommission an indexer peer from your indexer cluster, i.e. you don't want to add it back later, follow the link I shared and read the documentation on "Take a peer down permanently".
It talks about using splunk offline --enforce-counts to decommission the peer.

Before shutting down, this command will ensure that the cluster is put into a healthy state, i.e. RF and SF are met by the remaining peers before it shuts down

And when it's shut down, why would you even try to restart it!? Maybe I am misunderstanding...

[gcusello]

Hi xsstest
have you seen at https://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Removepeerfrommasterlist ?
Bye.
Giuseppe

[xsstest]

@cusello why did I restart the peer and it again appeared in my index cluster? so I think it is not really removed from the cluster

[xsstest]

@cusello Whether I should use splunk offline command