Deployment Architecture

Splunk 6.4.2: What are the proper procedures to update the RHEL7 OS, as to limit Splunk downtime?

New Member

Running on Splunk 6.4.2 Can someone tell me proper procedures to update the RHEL7 OS, as to limit Splunk downtime?

We have a clustered environment a master/deployment server, 4 indexers, 1 ES search head and 1 heavy forwarder (for syslog). We have kernel updates, w/several rpm pkg updates as well. We need to update the servers and reboot and I am not sure of the procedure to make sure we do it properly and not to lose ingestion. I saw in Answers how to move master to maintenance in an earlier version, but couldn't find anything on this newer version.

0 Karma


This should work for you :

On another note, if you want to reduce downtime in future, upgrade your search head also to a search head cluster and also add another HF for load balancing the syslog( if it's direct tcp)

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...