Deployment Architecture

I screwed up my search head cluster. How can I remove the nodes and re-establish the SH cluster again?

splunkIT
Splunk Employee
Splunk Employee

I have 3 search head cluster nodes in my test env. I won't go into details on how I broke the SH cluster. I would like to know how to reinitialize the nodes and re-establishing the SH cluster again. Thanks in advance for your advice.

Tags (1)

rbal_splunk
Splunk Employee
Splunk Employee

You can perform following steps to re-initialize the Search head Cluster.

1) Stop the Splunk Service for all Search Head Cluster Nodes.
2) Clear _raft folder from each SH Cluster ($SPLUNK_HOME/ var/run/splunk/_raft)
3) Start Splunk Service
4) Re-Initialize the Search Head Cluster Member using command below. Command provided in Splunk Documentation
5) Bootstrap SH Cluster Members - Command provided in Splunk Documentation

sk314
Builder

It would be better if we knew why you think you broke it. perhaps.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...