Installation

How to undo integration of SHC with multisite indexer cluster?

gkas99
Explorer

As part of deployment rollback, how do we undo integrating SHC with multisite indexer cluster done with following command from this instruction - https://docs.splunk.com/Documentation/Splunk/9.0.1/DistSearch/SHCandindexercluster#Configure_members ?

 

 

splunk edit cluster-config -mode searchhead -site site0 -manager_uri https://10.152.31.202:8089 -secret newsecret123 -auth login:password 

splunk restart

 

 

 

 

Labels (2)
0 Karma
1 Solution

chaker
Contributor

Hi @gkas99 

Do you want to revert to single site or distributed search?

All config for SHC is found under the [clustering] stanza in server.conf on each SH. You could open server.conf, remove the config for clustering and restart. This will give you a blank slate to configre the SH however you like.

If you want to go back to single site, the command above you provided will work, just remove the -site reference.

View solution in original post

chaker
Contributor

Hi @gkas99 

Do you want to revert to single site or distributed search?

All config for SHC is found under the [clustering] stanza in server.conf on each SH. You could open server.conf, remove the config for clustering and restart. This will give you a blank slate to configre the SH however you like.

If you want to go back to single site, the command above you provided will work, just remove the -site reference.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...