Deployment Architecture

What is the right order to change NTP setting in a clustered environment?

yossefn
Path Finder

Hi,

I need to change the NTP settings (in /etc/ntp.conf file) in a clustered environment (3 Indexers in cluster).

Is there some specific order I need to follow to make it in the right way (Maintenance mode maybe), or just to change one by one?

Thanks.

0 Karma
1 Solution

nickhills
Ultra Champion

To be honest, if you time is in sync when you make the change, you should be able to do this without any Splunk specific action.

It would only cause you issues if your Splunk indexers are wildly out of sync, and then jump a significant time (forwards or back) when you add the new NTP source.

The impact would be limited to sources which use the current index time(hopefully not many), but if your clocks were out by more than a few seconds (with reference to one another) I think you would already likely know about it with all sorts of other issues already manifesting.

Maintenance mode would not give you any real benefit for this change, unless you wanted to restart your peers as part of the process, in which case, use MM before you restart each IDX.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

To be honest, if you time is in sync when you make the change, you should be able to do this without any Splunk specific action.

It would only cause you issues if your Splunk indexers are wildly out of sync, and then jump a significant time (forwards or back) when you add the new NTP source.

The impact would be limited to sources which use the current index time(hopefully not many), but if your clocks were out by more than a few seconds (with reference to one another) I think you would already likely know about it with all sorts of other issues already manifesting.

Maintenance mode would not give you any real benefit for this change, unless you wanted to restart your peers as part of the process, in which case, use MM before you restart each IDX.

If my comment helps, please give it a thumbs up!
0 Karma

yossefn
Path Finder

hi @nickhillscpl, thanks for detailed answer.

Basically I wanted to specify the NTP servers because we're going to change our time in an hour forward this weekend, so I have to make sure that all the servers will get that change.
You right, the differences between the servers wasn't such a big, it's just because the time change.

Anyway, I did the change with the "Maintenance mode" just to be in the safe side. It all looks good now.
Thanks.

0 Karma

nickhills
Ultra Champion

Glad it worked for you, If you're happy, please accept my answer so others can easily see it in the future!
All the best!

If my comment helps, please give it a thumbs up!
0 Karma

yossefn
Path Finder
  1. On CM > "Splunk enable maintenance-mode"
  2. Change NTP on CM
  3. Change NTP on IDXs
  4. On CM > "Splunk disable maintenance-mode"
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...