dear everyone.
I hava an indexer cluster. It's have. It has eight indexers and one master node.
now . I want to remove an indexer (peer)? What should I do?
I've tried the following steps, but I don't know if it's right
first : running splunk stop
on that peer
second : running splunk remove cluster-peers -peers <guid>
but. When I start the indexer again, it appears again in the cluster
Each respondent asks me to look at different documents. What is the correct answer?
Well, have you read any of it? 😉
If you want to permanently decommission an indexer peer from your indexer cluster, i.e. you don't want to add it back later, follow the link I shared and read the documentation on "Take a peer down permanently".
It talks about using splunk offline --enforce-counts
to decommission the peer.
Before shutting down, this command will ensure that the cluster is put into a healthy state, i.e. RF and SF are met by the remaining peers before it shuts down
And when it's shut down, why would you even try to restart it!? Maybe I am misunderstanding...
Hi xsstest
have you seen at https://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Removepeerfrommasterlist ?
Bye.
Giuseppe
@cusello why did I restart the peer and it again appeared in my index cluster? so I think it is not really removed from the cluster
@cusello Whether I should use splunk offline command