We are trying to upgrade couple of indexers from our multi site cluster to a better hardware (16 core to 24 core etc). We decided to simply swap the disk to the new boxes to avoid unnecessary fix-up activities and save network traffic.
What is the best way to perform this upgrade?
I am thinking -
1. Initiate maintenance mode on the cluster by running “splunk enable maintenance-mode” command on the master node.
2. We have 4 indexers to upgrade, so we stop the splunkd process running on each indexer, one at a time by running “splunk stop” command
3. Move the disk to the new box
4. Start splunkd process on this server by running “splunk start” command
5. Repeat steps 2 to 4 for remaining indexers
6. Finally, disable maintenance mode by running “splunk disable maintenance-mode” command on the master node.
Or am I supposed to use Splunk Offline mode by extending the default interval?
Any advice?
↧