Why does the Topology view in S.o.S 3.0.1 continue to list a disabled peer as active under the SH detailed information on the right-hand side ?
At this time, the scheduled search maintaining the "sos_servers_cache" asset lookup that the Topology view consumes will add any newly-found search peers but will not remove those that no longer respond.
This is a limitation of the current implementation that we plan to improve on in a future release of S.o.S, where we will probably still show the non-responding peers but mark them as such ("missing" or "unresponsive").
In order to get rid of decommissioned search peers, you need to edit the $SPLUNK_HOME/etc/apps/sos/lookups/sos_servers_cache.csv
lookup table and manually remove their entries. We also hope to offer a UI-driven method to do this in a future release.
At this time, the scheduled search maintaining the "sos_servers_cache" asset lookup that the Topology view consumes will add any newly-found search peers but will not remove those that no longer respond.
This is a limitation of the current implementation that we plan to improve on in a future release of S.o.S, where we will probably still show the non-responding peers but mark them as such ("missing" or "unresponsive").
In order to get rid of decommissioned search peers, you need to edit the $SPLUNK_HOME/etc/apps/sos/lookups/sos_servers_cache.csv
lookup table and manually remove their entries. We also hope to offer a UI-driven method to do this in a future release.