Which command will permanently decommission a peer node operating in an indexer cluster?

Which command will permanently decommission a peer node operating in an indexer cluster?
A . splunk stop -f
B . splunk offline -f
C . splunk offline –enforce-counts
D . splunk decommission –enforce counts

View Answer

Answer: C

Explanation:

The splunk offline –enforce-counts command will permanently decommission a peer node operating in an indexer cluster. This command will remove the peer node from the cluster and delete its data. This command should be used when the peer node is no longer needed or is being replaced by another node. The splunk stop -f command will stop the Splunk service on the peer node, but it will not decommission it from the cluster. The splunk offline -f command will take the peer node offline, but it will not delete its data or enforce the replication and search factors. The splunk decommission – -enforce-counts command is not a valid Splunk command. For more information, see Remove a peer node from an indexer cluster in the Splunk documentation.