topic Automated splunk offline and enable/disable maintenance-mode for OS updates in Splunk Enterprise

Automated splunk offline and enable/disable maintenance-mode for OS updates

splunkreal — Wed, 29 Oct 2025 16:23:22 GMT

Hello, in ssh CLI running Redhat linux, how to launch splunk offline on indexers and on splunk manager node, enable or disable maintenance-mode without credentials (it asks for local admin username and password)?

This way we could automate OS updates by properly stop services.

Thanks for your help.

Re: Automated splunk offline and enable/disable maintenance-mode for OS updates

livehybrid — Wed, 29 Oct 2025 16:50:29 GMT

Hi @splunkreal

Just to clarify - Its asking for a Splunk admin authentication, not a local system account.

You need to enter the user/pass of an admin user in your Splunk instance - alternatively you can pass a Splunk auth token by adding the following to your CLI command

-token <yourToken>

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Automated splunk offline and enable/disable maintenance-mode for OS updates

PrewinThomas — Thu, 30 Oct 2025 03:27:26 GMT

@splunkreal
As @livehybrid mentioned, You cannot fully bypass Splunk authentication for maintenance‑mode operations. The splunk offline and splunk enable/disable maintenance-mode commands always require
Splunk admin credentials (not Linux root).

To automate, you should use either Splunk auth tokens or a service account with pre‑configured credentials in a script.

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Automated splunk offline and enable/disable maintenance-mode for OS updates

PickleRick — Thu, 30 Oct 2025 13:12:10 GMT

Adding to what has already been said - I would not recommend doing OS maintenance without a Splunk admin assist (or at least available on call). It is not OS administrator's area of competence to verify whether Splunk has shut down correctly, started correctly, is working correctly and so on. What if something happens when your environment is in maintenance mode? Will your OS admins be able to handle it properly? I wouldn't expect them to because it's not their job.