Upgrading from 7.2.5 to 7.3.3 to mitigate the Datetime.xml problem before the new year.
I have a multi-site indexer cluster, five peers in site1, five peers in site2.
I have a search head cluster, 6 members in site1 and 4 members in site2.
If I can use the [site-by-site upgrade option](https://docs.splunk.com/Documentation/Splunk/7.3.3/Indexer/Upgradeacluster#Site-by-site_upgrade_for_multisite_indexer_clusters), then I can keep ingesting data and maintain integrity, I never have to bring down all indexers at once. However, this option doesn't seem to account for a search head cluster, where there is also a deployer to worry about.
It seems the other option is to [upgrade in tiers](https://docs.splunk.com/Documentation/Splunk/7.3.3/Indexer/Upgradeacluster#Upgrade_each_tier_separately). This option accounts for the deployer and I can do a rolling restart of the search head members, but the indexers must be brought down all at once.
Am I missing something in the docs? Or is it acceptable to somehow combine the two by nesting the site-by-site indexer upgrade within the tiered upgrade? Like this:
1. Upgrade the Cluster Master
2. [Perform a rolling upgrade](https://docs.splunk.com/Documentation/Splunk/7.3.3/DistSearch/SHCrollingupgrade) of the search head cluster
> a. Upgrade a non-captain member> b. Upgrade the other members> c. Upgrade the deployer> d. Finalize the rolling upgrade
3. Upgrade site1 indexers
4. Upgrade site2 indexers
Thanks for any help!
↧