Hi All,
I am trying to put one of our Cluster indexer peers into manual detentionand i get a boolean error:
CLI:
\bin>splunk edit cluster-config -manual_detention on_ports_enabled
E...
My cluster has IDXs going in and out of detention very quickly (only a couple of seconds of detention). I see messages on the CM like the following: 08-20-2020 08:35:00.682 -0700 INFO CMPeer - peer...
...ersist. Check for network connectivity from the cluster peer reporting this issue to the replication port of target peer. If this condition persists, you can temporarily put that peer in manual detention....
Hi All, We are embarking on moving our Splunk 8.1.3 servers from old version of RHEL to new RHEL servers. The servers names are going to be different and we currently have the config based on IP/h...
Hi,
We had put one of our Peers/Indexers (Lets name it IDX2) into manual detention using the command below:
Run in IDX2
/opt/splunk/bin/splunk edit cluster-config -manual_detention on
A...
...wo new indexer peers to the existing cluster. So for the moment we have 4 indexer nodes in production. The main goal should be to leave only the 2 new indexers up and running. I have read in another t...
So looking at the docs moving the index buckets is generally how you move data. However, I'm migrating a lot of data from multiple servers to one server and apparently moving the index buckets will b...
current Splunk architecture:
a standalone search head + an indexer cluster (contains three indexers)+ a cluster master node
I want to convert it intoa distributed search with a search h...
I've read on peers going intodetention status due to storage capacity restrictions, however, is it possible to manually place apeer in detention status so that the data present on it remains s...