Deployment Architecture

Procedure for Shutting Down a Fully Distributed Environment?

muebel
SplunkTrust
SplunkTrust

Suppose you have a fully distributed environment. A search head pool, Indexer Cluster, Intermediate Forwarders, Licensing Server, Deployment Server... what is the procedure to safely shutdown every one of the servers?

0 Karma
1 Solution

jmheaton
Path Finder

If your shutting it down for upgrade then this is the order we recently used:
1. Deployment Server
2. Licensing
3. Search Cluster
4. Intermediate Forwarders
5. Index Cluster

That will retain as much data as possible.

View solution in original post

jmheaton
Path Finder

If your shutting it down for upgrade then this is the order we recently used:
1. Deployment Server
2. Licensing
3. Search Cluster
4. Intermediate Forwarders
5. Index Cluster

That will retain as much data as possible.

Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...