Archive
Highlighted

Indexer Cluster and Cluster Master upgrade

Explorer

Hi All,

Can we upgrade the Indexer Cluster and Cluster Master with no downtime?
As per our security regulatory requirements we cannot have downtime for Splunk upgrade.
We will be upgrading from 6.5.3to 7.1.6
If yes, can you share the procedure.

regards,
Santosh

Tags (1)
0 Karma
Highlighted

Re: Indexer Cluster and Cluster Master upgrade

SplunkTrust
SplunkTrust

Hi,

Can you please let us know whether it is single site cluster or multi-site cluster ?

0 Karma
Highlighted

Re: Indexer Cluster and Cluster Master upgrade

SplunkTrust
SplunkTrust

Hi @santosh_hb,

You have two ways of doing it, either by bringing everything down :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Upgradeacluster#Upgrade_all_tiers_at_once

Or by splitting the tiers and upgrading servers separately :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Upgradeacluster#Upgrade_each_tier_separat...

The second approach will give you the lowest down time BUT your indexers will have to be down during the upgrade. It is however possible to do a rolling upgrade as shown here if you are running splunk version 7.1 or later :
https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Searchablerollingupgrade

Let me know if that helps.

Cheers,
David

0 Karma
Highlighted

Re: Indexer Cluster and Cluster Master upgrade

SplunkTrust
SplunkTrust

It depends on your definition of downtime. The cluster master cannot be upgraded without being restarted. During the restart it is "down", but the indexer cluster will continue to function.
The cluster itself can also be upgraded one indexer at a time, but each indexer must be down for a short time. If your replication and search factors are at least 2 then the cluster will continue to index data and process searches.
The procedure for upgrading a cluster is documented at https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Upgradeacluster.

---
If this reply helps you, an upvote would be appreciated.
0 Karma