How can I disable access to my indexers from a search head?

[jrodman]

In our organization we have 5 different search heads. One search head that is not under my control is overwhelming the search nodes that I'm responsible for. How can I disable the access to these nodes?

(Okay truth is, the above is a made up story, this is just trying to doc how you can -- if you need to -- disable access from the search head.)

[jrodman · Accepted solution]

Check out: http://www.splunk.com/base/Documentation/4.1.6/Admin/Configuredistributedsearch#Disable_trust_relati...

Generally speaking, the search head pushes one half of a key pair to the search node (index node) over ssl when setting up the link. So long as the search node still has the public key, and the search head still has a matching private key, the search node will allow access from the search head.

To sever this trust link, you can delete the public key located in $SPLUNK_HOME/etc/auth/distServerKeys/ on the search node, which will cause it to no longer accept requests from the search head on restart. This will result in some errors logged on the search head as it will continue to try to connect.