topic Re: Splunk 4.3 upgrade question - disable? in Installation

Splunk 4.3 upgrade question - disable?

gnovak — Mon, 27 Feb 2012 21:35:23 GMT

In the instructions here:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Upgradeyourdistributedenvironment

In the area where you are upgrading a distributed environment with multiple indexers and non-pooled search heads, it states that in step #4 you should:

Disable and upgrade one of the search heads. Do not allow it to restart.

What exactly do they mean by "disable"? Stop splunk?

The search head we are updating is our main search head. It's the main console everyone logs into to use splunk. It searches 3 other main indexers. It also indexes data itself. I'm assuming they mean to stop splunk?

Can anyone clarify what "disable" means?

If these instructions are for non-pooled search heads, I can't see how disable would mean disabling it from being searched on by the rest of the pool if it's a non-pooled search head.

Re: Splunk 4.3 upgrade question - disable?

jgedeon120 — Mon, 28 Sep 2020 11:27:14 GMT

$SPLUNK_HOME/bin/splunk disable boot-start
$SPLUNK_HOME/bin/splunk stop

Then do your upgrade(s).

$SPLUNK_HOME/bin/splunk enable boot-start
$SPLUNK_HOME/bin/splunk start

Re: Splunk 4.3 upgrade question - disable?

gnovak — Tue, 28 Feb 2012 22:22:44 GMT

Thank you very much

Re: Splunk 4.3 upgrade question - disable?

jgedeon120 — Tue, 28 Feb 2012 23:27:32 GMT

You're welcome.