Deployment Architecture

Indexer Clustering - One Peer will be down for Server Battery Replacement

jaracan
Communicator

Hi Splunkers,

One of our Splunk Clustered Indexer (Physical Server) will go thru to a battery replacement that might take around 1-2 hours. With this, we would like to seek your advice since this one Splunk Clustered Indexer (Physical Server) will be down for around 1-2 hours during the battery replacement. During the Splunk Clustered Indexer (Physical Server) battery replacement, do we need to initiate maintenance-mode or run splunk offline command?

We would like to hear your feedback to avoid bucket related issues.

Regards,
Kevin

Labels (1)
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

First enable maintenance mode and then take peer down with splunk offline command. Once peer will up again (I mean splunk service on peer node), disable maintenance mode.

0 Karma

jaracan
Communicator

If we will enable the Index Clustering in maintenance mode in Splunk Cluster Master, do we still need to run splunk offline on the Splunk Indexer that will go thru to a battery replacement that might take around 1-2 hours? Just wanted to check why do we still need splunk offline if we already enabled maintenance mode? Is there a specific reason for splunk offline? I believe, enabling maintenance mode will already prevent buckets from rolling unnecessarily, since maintenance mode halts most bucket fix-up activity. Your thoughts?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Yes you are correct, when you enable maintenance mode it will stop bucket fix-up activity (Still primary bucket reassignment will happen). When use splunk offline it will minimise disruption to running searches.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!