Deployment Architecture

Need to Re-install Cluster master

sat94541
Communicator

Was in the process of upgrading Splunk Cluster Master and all Cluster Peer from Splunk Version 6.1.1. to 6.1.2. All the Peers got upgraded fine, but the Cluster master upgrade failed.

Now we need to re-install Splunk Cluster Master.Please confirm the steps we need to follow.

Tags (2)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Assuming that you are planning to install Clusters master on the same machine with e same IP, the following steps should work for you.

1) I have suggestion you to make the backup of the current folder and files from the Cluster Master

1.1) As the cluster master create the bundle from location $SPLUNK_HOME/etc/master-apps , please make a backup of this folder.
1.2) All the Cluster Bundle are stored at location /home/rbal/cm604/var/run/splunk/cluster/remote-bundle, so you can take backup of this.
1.3) I don't believe that on cluster master you are doing any indexing or else you will need to back up the Data store location.

2) Next steps will be to do a fresh install of the Cluster master by following the steps below.

2.1) Un-install of existing install.
2.2) Install new instance of Splunk for version 6.1.4
2.3) stop the service
2.4) First copy the $BACKUP_LOCATIONlocation/etc/master-apps to $SPLUNK_HOME/etc/master-apps. This steps is very important.
2.5) Start the Splunk service and enable cluster using same secrete as used in the past. When the master comes up, it will check create new bundle and push them to the peer, bundle will be created based on apps and files in $SPLUNK_HOME/etc/master-apps.
2.6) Peer will get the bundle and go through the rolling restart

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...