I wonder whether during a Splunk upgrade we can use our two sites of the multisite indexer cluster to improve the Splunk upgrade. Meaning, is it possible to upgrade the indexers of one site and then upgrade the indexers of the second site?
In our upgrade last week we simply upgraded all the indexers together and it took the indexers over 12 hours to catch up with the indexing load, replication and buckets fix-up.
It relates to [Large amount of buckets that need to be fixed after the upgrade?][1]
[1]: https://answers.splunk.com/answers/753818/large-amount-of-buckets-that-need-to-be-fixed-afte.html
↧