topic Upgrading hardware on Indexers in cluster (one peer at a time) in Splunk Enterprise

Upgrading hardware on Indexers in cluster (one peer at a time)

braxton839 — Thu, 26 Jun 2025 15:35:42 GMT

I think I know how to do this but I thought it would be best to check with some of the experts here first.

I am upgrading the hardware (storage expansion) on our indexers and this will require turning off and unplugging each device. Indexers are clustered with a Replication Factor of 2.

From what I have read:

I can issue the 'splunk offline' command on the indexer I am working on
Wait for the indexer to wrap up any tasks
Then shut down and unplug the machine to perform this upgrade
Once complete, I can plug it back in and turn it back on (make sure Splunk starts running again)

Am i missing anything important?

Thanks!

Re: Upgrading hardware on Indexers in cluster (one peer at a time)

livehybrid — Thu, 26 Jun 2025 15:58:22 GMT

Hi @braxton839

This looks good to me - Check the cluster manager first to ensure that things are in a good shape before offline-ing your indexer.

Be aware that with a RF of 2 you can only safely take down a single indexer at a time, and whilst it is down you are at risk of reduced data availability if your other indexers run into any problems.

Theres some good reading at https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/9.3/manage-the-indexer-cluster/take-a-peer-offline if it helps, but you may have already seen this.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Upgrading hardware on Indexers in cluster (one peer at a time)

braxton839 — Thu, 26 Jun 2025 16:02:10 GMT

Thanks!

Which user should I be logged in as to run 'splunk offline', root or splunk?