What I've tried:
On the indexer:
splunk offline --enforce-counts
On the master, observing splunk_monitoring_console/indexer_clustering_status
indexer goes to decommissioning but goes back to on after a few seconds.
On the indexer:
splunk offline
On the master, observe splunk_monitoring_console/indexer_clustering_status
indexer goes away but after a few seconds, it returns to on.
On the master:
splunk edit cluster-config -restart_timeout 1800
restart splunk
On the indexer:
splunk offline --enforce-counts
On the master
observe splunk_monitoring_console/indexer_clustering_status
indexer goes to decommissioning but goes back to on after a few seconds.
Thanks in advance.
... View more