Hello EveryOne ,
Please Help Me Regarding How to Remove Splunk Search heads From Splunk Master Or Cluster
We Have Some Splunk Dedicated Search Heads In Our Environment. Ex: 15 Search Heads . In That 7 Search Heads Are Down, Because The Users Are Stopped Using Splunk Search Heads. . So Now We Are Planning To Remove Those 7 search heads from our Splunk Master . What Is Procedure . could Anyone Explain Me In Manual Way. It Would Be Great. .
Please Also Check One Screen Shot I Have Shared . Find Below , We Need to Remove These Search Heads.
Regards
Hello @isoutamo ,
Could You Please Provide me The Step By Step Document To Remove Search Heads From Splunk Master . It Would Be Very Helpful To me please
Hi
If it's still inSHC, then remove it from there: https://docs.splunk.com/Documentation/Splunk/8.2.3/DistSearch/Removeaclustermember
Remove "search peer" (your SHC member from MC/CM acting as MC): https://docs.splunk.com/Documentation/Splunk/8.2.3/DistSearch/Removeasearchpeer
Then update MC's inventory:
Settings -> MC -> General Setup -> Apply Changes
Then it should be ok.
r. Ismo
Hi @anil1432
search heads must have been clustered to use this link. This has detailed steps, Master/Manager used in indexers world. Where as Search heads having captain. Captain doesn't play a role in removing the member as per steps above.
https://docs.splunk.com/Documentation/Splunk/8.2.2/DistSearch/Removeaclustermember
--
An upvote would be appreciated if this reply helps!
Hi
If you refer Monitoring Console as a cluster master, then just remove those indexer peers from Distributed search and then apply new config on MC's settings pages.
r. Ismo