Deployment Architecture

What is the right order to change NTP setting in a clustered environment?

yossefn
Path Finder

Hi,

I need to change the NTP settings (in /etc/ntp.conf file) in a clustered environment (3 Indexers in cluster).

Is there some specific order I need to follow to make it in the right way (Maintenance mode maybe), or just to change one by one?

Thanks.

0 Karma
1 Solution

nickhills
Ultra Champion

To be honest, if you time is in sync when you make the change, you should be able to do this without any Splunk specific action.

It would only cause you issues if your Splunk indexers are wildly out of sync, and then jump a significant time (forwards or back) when you add the new NTP source.

The impact would be limited to sources which use the current index time(hopefully not many), but if your clocks were out by more than a few seconds (with reference to one another) I think you would already likely know about it with all sorts of other issues already manifesting.

Maintenance mode would not give you any real benefit for this change, unless you wanted to restart your peers as part of the process, in which case, use MM before you restart each IDX.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

To be honest, if you time is in sync when you make the change, you should be able to do this without any Splunk specific action.

It would only cause you issues if your Splunk indexers are wildly out of sync, and then jump a significant time (forwards or back) when you add the new NTP source.

The impact would be limited to sources which use the current index time(hopefully not many), but if your clocks were out by more than a few seconds (with reference to one another) I think you would already likely know about it with all sorts of other issues already manifesting.

Maintenance mode would not give you any real benefit for this change, unless you wanted to restart your peers as part of the process, in which case, use MM before you restart each IDX.

If my comment helps, please give it a thumbs up!
0 Karma

yossefn
Path Finder

hi @nickhillscpl, thanks for detailed answer.

Basically I wanted to specify the NTP servers because we're going to change our time in an hour forward this weekend, so I have to make sure that all the servers will get that change.
You right, the differences between the servers wasn't such a big, it's just because the time change.

Anyway, I did the change with the "Maintenance mode" just to be in the safe side. It all looks good now.
Thanks.

0 Karma

nickhills
Ultra Champion

Glad it worked for you, If you're happy, please accept my answer so others can easily see it in the future!
All the best!

If my comment helps, please give it a thumbs up!
0 Karma

yossefn
Path Finder
  1. On CM > "Splunk enable maintenance-mode"
  2. Change NTP on CM
  3. Change NTP on IDXs
  4. On CM > "Splunk disable maintenance-mode"
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...