Indexer Clustering - One Peer will be down for Server Battery Replacement

[jaracan]

Hi Splunkers,

One of our Splunk Clustered Indexer (Physical Server) will go thru to a battery replacement that might take around 1-2 hours. With this, we would like to seek your advice since this one Splunk Clustered Indexer (Physical Server) will be down for around 1-2 hours during the battery replacement. During the Splunk Clustered Indexer (Physical Server) battery replacement, do we need to initiate maintenance-mode or run splunk offline command?

We would like to hear your feedback to avoid bucket related issues.

Regards,
Kevin

[harsmarvania57]

Hi,

First enable maintenance mode and then take peer down with splunk offline command. Once peer will up again (I mean splunk service on peer node), disable maintenance mode.

[jaracan]

If we will enable the Index Clustering in maintenance mode in Splunk Cluster Master, do we still need to run splunk offline on the Splunk Indexer that will go thru to a battery replacement that might take around 1-2 hours? Just wanted to check why do we still need splunk offline if we already enabled maintenance mode? Is there a specific reason for splunk offline? I believe, enabling maintenance mode will already prevent buckets from rolling unnecessarily, since maintenance mode halts most bucket fix-up activity. Your thoughts?

[harsmarvania57]

Yes you are correct, when you enable maintenance mode it will stop bucket fix-up activity (Still primary bucket reassignment will happen). When use splunk offline it will minimise disruption to running searches.