Our Splunk Cluster Master is under resourced. To match Splunk support's recommendations we need to add CPU and RAM to it. We have 8 indexers on an indexer cluster. This upgrade will require about 30 minutes of downtime of our cluster master server.
What's the best approach for a cluster master hardware upgrade?
Put the cluster in maintenance mode, stop the cluster master, shut down the cluster master, perform the upgrade, restart the cluster master, restart splunk (note splunk may be set to auto start), exiting maintenance mode occurs automatically with restarts.
Maintenance mode does not persist across master restarts.