To remove a search peer from a search head in a distributed search environment using the CLI, Splunk provides the splunk remove search-server command. This command is executed on the search head and removes the specified search peer from its configuration.
The correct syntax for this command is:
splunk remove search-server -auth ::
Where:
: are the credentials for the search head.
: specifies the management port of the search peer to be removed.
This command removes the search peer from the search head's configuration. It's important to note that this action does not affect the search peer itself; it merely removes the association from the search head.
[Reference:, Remove a search peer - Splunk Documentation, , ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit