Splunk 6.4.2: What are the proper procedures to update the RHEL7 OS, as to limit Splunk downtime?

[adkinsdiet]

Running on Splunk 6.4.2 Can someone tell me proper procedures to update the RHEL7 OS, as to limit Splunk downtime?

We have a clustered environment a master/deployment server, 4 indexers, 1 ES search head and 1 heavy forwarder (for syslog). We have kernel updates, w/several rpm pkg updates as well. We need to update the servers and reboot and I am not sure of the procedure to make sure we do it properly and not to lose ingestion. I saw in Answers how to move master to maintenance in an earlier version, but couldn't find anything on this newer version.

[renjith_nair]

This should work for you :

http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/Upgradeacluster#Upgrade_to_a_new_maintenan...

On another note, if you want to reduce downtime in future, upgrade your search head also to a search head cluster and also add another HF for load balancing the syslog( if it's direct tcp)