Deployment Architecture

I screwed up my search head cluster. How can I remove the nodes and re-establish the SH cluster again?

splunkIT
Splunk Employee
Splunk Employee

I have 3 search head cluster nodes in my test env. I won't go into details on how I broke the SH cluster. I would like to know how to reinitialize the nodes and re-establishing the SH cluster again. Thanks in advance for your advice.

Tags (1)

rbal_splunk
Splunk Employee
Splunk Employee

You can perform following steps to re-initialize the Search head Cluster.

1) Stop the Splunk Service for all Search Head Cluster Nodes.
2) Clear _raft folder from each SH Cluster ($SPLUNK_HOME/ var/run/splunk/_raft)
3) Start Splunk Service
4) Re-Initialize the Search Head Cluster Member using command below. Command provided in Splunk Documentation
5) Bootstrap SH Cluster Members - Command provided in Splunk Documentation

sk314
Builder

It would be better if we knew why you think you broke it. perhaps.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...