I've tested and confirmed that when you add the enforce_counts=true to the api call like seen below, it will perform a full decommissioning of the host. Thank you for bringing it up!   curl -k -u admin:pass https://indexer:8089/services/cluster/slave/control/control/decommission -d enforce_counts=true -X POST     ... View more

@vtalanki I know this is a bit older but for you or anyone that is coming from Google search, the decommission API endpoint actually enacts the same as a splunk offline command. This means that it will take the indexer down temporarily and then later decommission the indexer should it not come back up in the allowed restart time. The same as what's found in the documentation: Take a peer offline - Splunk Documentation If you want to take down host permanently, you need to add a -d enforce_counts=true parameter to your curl command. This does the same as a splunk offline --enforce-counts command. ... View more

You don't include the private key. Splunk doesn't use it. The cert itself needs to have a password applied to it. And then the cert and intermediate cert chains are what are used in the "caCertFile" and "serverCert" settings. ... View more

Check my above answer to see if that helps you out. ... View more

I ran into this issue a bit myself. What I found needed to happen was to configure these settings in $SPLUNK_HOME/etc/system/local/server.conf [sslConfig] caCertFile = <ABSOLUTE_PATH_TO_CA_FILE> serverCert = <ABSOLUTE_PATH_TO_SERVER_CERT_FILE> sslPassword = <PASSWORD> The key that I had to take note of was that the "sslPassword" setting needed to be present. Otherwise it inherited the default "sslPassword" setting and failed to initialize SSL. If your third party SSL cert didn't come with a password, you can create one using openssl like this: openssl rsa -in splunk_ssl.pem -out splunk_ssl.pem -des3 ... View more

I had a similar issue. I found out that I had actually run out of disk space on the RAID where my indexes were stored. That may be something to look into. ... View more