Deployment Architecture

Rolling Upgrade on a big cluster

aramey
Engager

With hundreds of indexer nodes in a cluster, it might take more than one business day to upgrade them all during a rolling upgrade. And thus indexers would run on different versions for a short while (while documentation states that indexers within a cluster should all be the same version.)

Is it possible to split the rolling upgrade process between two business days?
If yes, should the cluster master be kept into 'rolling upgrade' mode during the night between the two rollouts?
Thanks

0 Karma
1 Solution

hmallett
Path Finder

Yes, you can take as long as you need for the rolling upgrade, you just accept that you can't do any other cluster maintenance (including bundle pushes) during the upgrade.
I would personally keep the cluster master in rolling upgrade mode overnight. I don't know what the implications of taking it out of that mode while the indexers are mixed versions would be though.

View solution in original post

0 Karma

hmallett
Path Finder

Yes, you can take as long as you need for the rolling upgrade, you just accept that you can't do any other cluster maintenance (including bundle pushes) during the upgrade.
I would personally keep the cluster master in rolling upgrade mode overnight. I don't know what the implications of taking it out of that mode while the indexers are mixed versions would be though.

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...