One of our Splunk Clustered Indexer (Physical Server) will go thru to a battery replacement that might take around 1-2 hours. With this, we would like to seek your advice since this one Splunk Clustered Indexer (Physical Server) will be down for around 1-2 hours during the battery replacement. During the Splunk Clustered Indexer (Physical Server) battery replacement, do we need to initiate maintenance-mode or run splunk offline command?
We would like to hear your feedback to avoid bucket related issues.
If we will enable the Index Clustering in maintenance mode in Splunk Cluster Master, do we still need to run splunk offline on the Splunk Indexer that will go thru to a battery replacement that might take around 1-2 hours? Just wanted to check why do we still need splunk offline if we already enabled maintenance mode? Is there a specific reason for splunk offline? I believe, enabling maintenance mode will already prevent buckets from rolling unnecessarily, since maintenance mode halts most bucket fix-up activity. Your thoughts?
Yes you are correct, when you enable maintenance mode it will stop bucket fix-up activity (Still primary bucket reassignment will happen). When use splunk offline it will minimise disruption to running searches.