Deployment Architecture

Shutdown and start order in a clustered /distributed architecture

New Member


I have an environment with the following architecture: 2 Search Heads, 2 Idx, 1 Dep Server, 1 Cluster Master, 2 Heavy forwarder, >500 UF.

I have to shoot down and than start all the nodes.

My question is: does exists a specific order or precedure to follow? What is the best practice in this cases?

Thank you


Tags (1)
0 Karma


HI @giorgiovolpini,
for the Splunk Servers, the only behaviour is to not shutdown at the same time both the servers of the same kind.
For Universal forwarders, there isn't any rule.

In othe words, there isn't an order to shutdown: shutdown all the servers one by one.
It's different if you have to upgrade Splunk, but it's a different question!


Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...