https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130695#M4960 <P>This should have appeared as a reply to "sowings".</P> Tue, 06 Jun 2017 18:20:09 GMT IamaRobot 2017-06-06T18:20:09Z https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130687#M4952 <P>I am at a client where, by policy, they must restart servers every week. They have an 8-node Search Head Cluster. What is the best method for restarting it?</P> <P>(Is there a maintenance mode, such as indexer clustering? Do they need to run any command before/after the restart? Should they restart 1, 2, 3, 8 at a time?)</P> Fri, 29 May 2015 10:40:38 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130687#M4952 Jason 2015-05-29T10:40:38Z https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130688#M4953 <P>There is no maintenance mode in SHC. The nodes can be restarted in any order you want. It's a question of whether you want to maintain availability during the restart process. If availability is not required, then you can restart them all at once. </P> Fri, 29 May 2015 13:52:38 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130688#M4953 mahamed_splunk 2015-05-29T13:52:38Z https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130689#M4954 <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/RestartSHC">http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/RestartSHC</A></P> Fri, 29 May 2015 14:01:55 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130689#M4954 sowings 2015-05-29T14:01:55Z https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130690#M4955 <P>Great - thanks. Restarting them all servers at once will not cause unnecessary replication, assuming that some may come back online before others?</P> Fri, 29 May 2015 14:04:14 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130690#M4955 Jason 2015-05-29T14:04:14Z https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130691#M4956 <P>I need to know how to restart the servers themselves, not run a rolling restart on the Splunk instances.</P> Fri, 29 May 2015 14:04:44 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130691#M4956 Jason 2015-05-29T14:04:44Z https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130692#M4957 <P>Splunk won't trigger a restart of the host OS. Maintenance mode is not required, because the SHC is a bit less paranoid about satisfying replication of the artifacts. We're not talking about <EM>data fidelity</EM>, we're talking about cached copies of the searches that have been run. If you're talking about replication of knowledge objects, that will always happen across all nodes.</P> Fri, 29 May 2015 14:11:20 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130692#M4957 sowings 2015-05-29T14:11:20Z https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130693#M4958 <P>Yes. I'm saying a restart of the host OS is required by policy, and I needed to know the best way to do it for the clustered search heads. It sounds like all at once is sufficient.</P> Fri, 29 May 2015 14:18:39 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130693#M4958 Jason 2015-05-29T14:18:39Z https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130694#M4959 <P>This is a link to the docs, but the docs don't address this question. We want to know if rolling restarts perform what I would call a "graceful" restart. For a good description of how a graceful restart should work see this description from Apache <A href="https://httpd.apache.org/docs/2.4/stopping.html#graceful">https://httpd.apache.org/docs/2.4/stopping.html#graceful</A> </P> <P>Users would expect a graceful restart to dis allow new searches, but allow currently running searches to finish before restarting. </P> Tue, 06 Jun 2017 18:19:11 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130694#M4959 IamaRobot 2017-06-06T18:19:11Z https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130695#M4960 <P>This should have appeared as a reply to "sowings".</P> Tue, 06 Jun 2017 18:20:09 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/130695#M4960 IamaRobot 2017-06-06T18:20:09Z https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/671966#M27775 <P>To perform rolling restart of SH cluster use,</P><P><SPAN>splunk rolling-restart shcluster-members</SPAN></P><P><SPAN>To check the current status of rolling restart use,&nbsp;</SPAN></P><P><SPAN>splunk rolling-restart shcluster-members -status 1</SPAN></P> Thu, 14 Dec 2023 19:54:32 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-restart-a-SHC-search-head-cluster-at-the-server-level/m-p/671966#M27775 pkumar9610 2023-12-14T19:54:32Z