- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Totally Disable Search head Clustering
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have 2 nodes in my Search Head cluster and want to disable the Search head Clustering fully. I have a deployer also, which I used during configuration of Search Head Cluster.
In the documentations, I can see only "Remove cluster member" but there is no documentation on how to disable and remove Search Head Clustering fully. Please help on how to disable and remove Search head cluster ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk recommends at least 3 instances to create search head cluster. Run below commands in each search-head members to disable search-head clustering.
Remove the member:
splunk remove shcluster-memberDisable the member:
splunk disable shcluster-configClean the KVStore:
splunk clean kvstore --cluster
Reference:
https://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/Removeaclustermember
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You would have a configuration in your servers.conf.
Ideally, this should be in your system/local. But can differ depending on your configuration.
The servers.conf will have a stanza [shclustering].
Remove all configuration under this stanza on all your SH.
Do a restart.
Your SH clustering will be removed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk recommends at least 3 instances to create search head cluster. Run below commands in each search-head members to disable search-head clustering.
Remove the member:
splunk remove shcluster-memberDisable the member:
splunk disable shcluster-configClean the KVStore:
splunk clean kvstore --cluster
Reference:
https://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/Removeaclustermember
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have 2 nodes in my search head cluster, do I need to do above steps on both the nodes one by one ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. Execute these commands on each search-head members (one by one).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ok got it. Thanks. I will revert back.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have tried that command but I am getting issues, when I run disable member command on the captain, the command is getting stuck and doing nothing ? In my case I have 2 nodes in a cluster the member node was removed successfully.
But running that command on captain is not working, as I think it is trying to find the another captain to remove that member. What can be done in this case ?
Should I comment "clustering" stanza on Captain and take a restart ? Please advise ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Update 'disabled' key to 1 in 'shclustering' stanza of your 'server.conf' file and restart the Splunk instance.
[shclustering]
disabled = 1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
But I think this will only disable one of the member of the cluster. Whether it will totally disable Search head clustering ? Also, whether I have to do any steps on Deployer to disable any services on it ? Please advise ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have updated my answer with steps. Kindly accept the answer if it's helpful.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sure I will try this out and revert back. Thanks.
Detecting Remote Code Executions With the Splunk Threat Research Team
Observability | Use Synthetic Monitoring for Website Metadata Verification
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
