Deployment Architecture

How to push configuration bundle from cluster master to indexers- but explicitly DO NOT restart

st4ple
Path Finder

In Indexer Clustering, is there a way to push the configuration bundle from a Cluster Master to the Indexers and explicitly don't restart the Indexers?

I'm thinking there might be an updated configuration bundle (which requires a restart of the Indexers) that I want to distribute to the Indexers but only execute the restart of the Indexers at a later moment (i.e. a scheduled time-window when the load is low on the Indexers).

For Search Head Clustering, this is possible and documented (https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/PropagateSHCconfigurationchanges#Contr...), but for Indexer Clustering I didn't find any mention in the documentation.

0 Karma
1 Solution

dhihoriya_splun
Splunk Employee
Splunk Employee

Hi @st4ple

To push the cluster bundle on the indexer you need a rolling restart on the indexer but it depends on your bundle configuration like some time for some config you just have to reload the indexers no need to restart them (It will automatically done when you are applying cluster bundle to the indexer) but if your configuration needed rolling restart then you can't stage the bundle on all the indexer and schedule a restart activity for any other time.

View solution in original post

dhihoriya_splun
Splunk Employee
Splunk Employee

Hi @st4ple

To push the cluster bundle on the indexer you need a rolling restart on the indexer but it depends on your bundle configuration like some time for some config you just have to reload the indexers no need to restart them (It will automatically done when you are applying cluster bundle to the indexer) but if your configuration needed rolling restart then you can't stage the bundle on all the indexer and schedule a restart activity for any other time.

st4ple
Path Finder

Thanks for your answer, @dhihoriya_splunk . I was hoping that staging bundles for a later restart would be somehow possible for Indexer Clusters since it exists for Search Head Clusters.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...