What is the right order to change NTP setting in a clustered environment?

[yossefn]

Hi,

I need to change the NTP settings (in /etc/ntp.conf file) in a clustered environment (3 Indexers in cluster).

Is there some specific order I need to follow to make it in the right way (Maintenance mode maybe), or just to change one by one?

Thanks.

[nickhills · Accepted solution]

To be honest, if you time is in sync when you make the change, you should be able to do this without any Splunk specific action.

It would only cause you issues if your Splunk indexers are wildly out of sync, and then jump a significant time (forwards or back) when you add the new NTP source.

The impact would be limited to sources which use the current index time(hopefully not many), but if your clocks were out by more than a few seconds (with reference to one another) I think you would already likely know about it with all sorts of other issues already manifesting.

Maintenance mode would not give you any real benefit for this change, unless you wanted to restart your peers as part of the process, in which case, use MM before you restart each IDX.

[yossefn]

hi @nickhillscpl, thanks for detailed answer.

Basically I wanted to specify the NTP servers because we're going to change our time in an hour forward this weekend, so I have to make sure that all the servers will get that change.
You right, the differences between the servers wasn't such a big, it's just because the time change.

Anyway, I did the change with the "Maintenance mode" just to be in the safe side. It all looks good now.
Thanks.

[nickhills]

Glad it worked for you, If you're happy, please accept my answer so others can easily see it in the future!
All the best!

[yossefn]

1. On CM > "Splunk enable maintenance-mode"
2. Change NTP on CM
3. Change NTP on IDXs
4. On CM > "Splunk disable maintenance-mode"