Getting Data In

Quarantine or peer removal

7aurelius
Loves-to-Learn

Hi,

Is there a way to remove or quarantine multiple search peers (indexers) at the same time? It's not practical enough for me to do it for on every search (one by one) head like the document states. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

If you have shell access you can try this https://docs.splunk.com/index.php?title=Documentation:Splunk:DistSearch:Quarantineasearchpeer:6.2.0&...

Just loop over your nodes. 

r. Ismo

0 Karma

7aurelius
Loves-to-Learn

The indexers are not clustered. They are standalone.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

removing number of indexers from your indexer cluster depends on your replication & search factor. for example if you have replication factor 2 and you would like to remove two indexers, there is a high chance of having two copies in those indexers. hence you can't remove indexers at same time. you can remove one by one.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...