I have a Splunk deployment with two Splunk Receivers and a cluster master operating together as a indexer cluster.
I am looking to do some Windows OS updates to all the machines. In preparation for this i have been looking online at some of the Splunk doco.
I have read doco about putting a cluster in maintenance mode (see Ref 1) as well as doco about taking a peer offline (see Ref 2)
Is it best to first put the cluster into Maintenance Mode and then put one of the Indexers into "offline" mode and then perform the necessary updates to the offline indexer?
Would i be correct in assuming that whilst in Maintenance Mode, Indexers (that are still online) will still be able to successfully ingest data (it just won't roll hot buckets during this time)?
Since I'm not sure how long the updates will take, is there a maximum restart_timeout value that can be assigned to the cluster when taking a peer offline?
When performing updates on a cluster master, is it simply necessary to put the Cluster Master in Maintenance Mode?
Ref 1: https://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Usemaintenancemode
Ref 2: https://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Takeapeeroffline
↧