topic Re: What is the difference between maintenance mode versus off-line during a Linux patch? in Getting Data In

What is the difference between maintenance mode versus off-line during a Linux patch?

ddrillic — Fri, 16 Mar 2018 14:52:02 GMT

We have a Linux patch which requires a server reboot scheduled tonight for one out of the ten indexers. The patch would be applied at night at some point.

We wonder whether we should put the entire cluster on maintenance mode or maybe take this specific indexer off-line for the whole night.

Re: What is the difference between maintenance mode versus off-line during a Linux patch?

ddrillic — Fri, 16 Mar 2018 15:17:21 GMT

Our sales engineer said -

Well don't put the entire cluster in maintenance mode, that would cause an enormous amount of load when you brought it out of maintenance mode, and makes your new data since the maintenance mode went into effect very unsafe.

No, offline that server nicely and add it back at your leisure.

Re: What is the difference between maintenance mode versus off-line during a Linux patch?

tiagofbmm — Fri, 16 Mar 2018 15:54:06 GMT

Well as the docs say,

Maintenance mode halts most bucket fixup activity and prevents frequent rolling of hot buckets.

https://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Usemaintenancemode

What will happen when you put that peer offline is that all the hot buckets will be rolled to warm as a result of the splunk stop command.

If you do this very often, you may end up having very small buckets in your environment, which is not great as Splunk would need to check several buckets for the data someone has searched instead of few.

Re: What is the difference between maintenance mode versus off-line during a Linux patch?

ddrillic — Fri, 16 Mar 2018 17:21:22 GMT

Just found a good discussion at Is it better to use 'offline' mode or 'maintenance mode' in a multisite indexer cluster when a peer node will be down for an extended amount of time for maintenance?