https://community.splunk.com/t5/Splunk-Enterprise-Security/reboot-splunk-instance-after-OS-patching/m-p/402657#M4610 <P>I would suggest you perform the proposed activity on a test server [ can be single instance, if you don't have a cluster setup] which same OS level patches/versions and same version of splunk instance as prod. This can prove that the reboot of the OS works fine and the splunk starts up clean.<BR /> - Ensure your instances are setup boot enable splunk <BR /> - watch for any errors in splunkd.logs and python logs related to OS and splunk apps/add-ons on your instance<BR /> - If you are happy, you can select a quite period [ out of office hours, when the load and incoming data is minimal], put the master in maintenance mode, restart/reboot the cluster master and ensure it comes up and all peer nodes connect successfully.<BR /> - take out each search peer on to a maintenance mode or offline (ensure they are are in maintenance mode) and reboot and re-enable them<BR /> - between each peer node reboot, ensure the nodes </P> <P>You may also want to refer to <A href="https://answers.splunk.com/answers/352976/what-is-the-correct-procedure-to-patch-the-os-and.html">https://answers.splunk.com/answers/352976/what-is-the-correct-procedure-to-patch-the-os-and.html</A> <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Upgradeacluster#Upgrade_to_a_maintenance_release">https://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Upgradeacluster#Upgrade_to_a_maintenance_release</A></P> Tue, 09 Apr 2019 07:52:03 GMT lakshman239 2019-04-09T07:52:03Z https://community.splunk.com/t5/Splunk-Enterprise-Security/reboot-splunk-instance-after-OS-patching/m-p/402656#M4609 <P><A href="https://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Userollingrestart">link text</A></P> <P>We patch our OS last week and OS admin advise us to reboto the Indexers once. we have multistie scenerios. (6+6).</P> <P>Please suggest a best method to reboot OS without effecting index searching capability.</P> Tue, 09 Apr 2019 07:10:51 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/reboot-splunk-instance-after-OS-patching/m-p/402656#M4609 rashid47010 2019-04-09T07:10:51Z https://community.splunk.com/t5/Splunk-Enterprise-Security/reboot-splunk-instance-after-OS-patching/m-p/402657#M4610 <P>I would suggest you perform the proposed activity on a test server [ can be single instance, if you don't have a cluster setup] which same OS level patches/versions and same version of splunk instance as prod. This can prove that the reboot of the OS works fine and the splunk starts up clean.<BR /> - Ensure your instances are setup boot enable splunk <BR /> - watch for any errors in splunkd.logs and python logs related to OS and splunk apps/add-ons on your instance<BR /> - If you are happy, you can select a quite period [ out of office hours, when the load and incoming data is minimal], put the master in maintenance mode, restart/reboot the cluster master and ensure it comes up and all peer nodes connect successfully.<BR /> - take out each search peer on to a maintenance mode or offline (ensure they are are in maintenance mode) and reboot and re-enable them<BR /> - between each peer node reboot, ensure the nodes </P> <P>You may also want to refer to <A href="https://answers.splunk.com/answers/352976/what-is-the-correct-procedure-to-patch-the-os-and.html">https://answers.splunk.com/answers/352976/what-is-the-correct-procedure-to-patch-the-os-and.html</A> <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Upgradeacluster#Upgrade_to_a_maintenance_release">https://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Upgradeacluster#Upgrade_to_a_maintenance_release</A></P> Tue, 09 Apr 2019 07:52:03 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/reboot-splunk-instance-after-OS-patching/m-p/402657#M4610 lakshman239 2019-04-09T07:52:03Z