Monitoring Splunk

How do I tell if an indexer is in maintenance mode?

Jason
Motivator

On the CLI of a clustered indexer, what a command I can run (or perhaps a search, if REST needs to be hit) that will tell me if the cluster is in maintenance mode right now or not?

Tags (2)
0 Karma
1 Solution

Jason
Motivator

Figured it out. Maintenance mode is listed as 0 (disabled) or 1 (enabled) in:

$ ./splunk list peer-info
    slave
            base_generation_id:345
            is_registered:1
            last_heartbeat_attempt:0
            maintenance_mode:1
            restart_state:NoRestart
            site:default
            status:Up

View solution in original post

0 Karma

Jason
Motivator

Figured it out. Maintenance mode is listed as 0 (disabled) or 1 (enabled) in:

$ ./splunk list peer-info
    slave
            base_generation_id:345
            is_registered:1
            last_heartbeat_attempt:0
            maintenance_mode:1
            restart_state:NoRestart
            site:default
            status:Up
0 Karma

vasanthmss
Motivator

Hi Jason,

For checking the cluster master status from search peers or the search head run this command from web ui or the command line, (status will be described below 0/1 for the maintenance mode)
web ui

|rest /services/cluster/master/info

command line:

/opt/splunk/bin/splunk search "|rest /services/cluster/master/info"

Go to your cluster master and execute this command, '

./splunk show maintenance-mode

Maintenance mode : 0 indicates maintenance mode is OFF.
Maintenance mode : 1 indicates maintenance mode is ON.
or

login to your cluster master web UI and , settings -> index clustering, there you can see the status.

Thanks,
V

V

Jason
Motivator

I'm on the cli of the indexer, not the cluster master. as indexers aren't search peers of the cluster master, the above rest command won't work. Thanks though.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...