Deployment Architecture

What is the right order to change NTP setting in a clustered environment?

yossefn
Path Finder

Hi,

I need to change the NTP settings (in /etc/ntp.conf file) in a clustered environment (3 Indexers in cluster).

Is there some specific order I need to follow to make it in the right way (Maintenance mode maybe), or just to change one by one?

Thanks.

0 Karma
1 Solution

nickhills
Ultra Champion

To be honest, if you time is in sync when you make the change, you should be able to do this without any Splunk specific action.

It would only cause you issues if your Splunk indexers are wildly out of sync, and then jump a significant time (forwards or back) when you add the new NTP source.

The impact would be limited to sources which use the current index time(hopefully not many), but if your clocks were out by more than a few seconds (with reference to one another) I think you would already likely know about it with all sorts of other issues already manifesting.

Maintenance mode would not give you any real benefit for this change, unless you wanted to restart your peers as part of the process, in which case, use MM before you restart each IDX.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

To be honest, if you time is in sync when you make the change, you should be able to do this without any Splunk specific action.

It would only cause you issues if your Splunk indexers are wildly out of sync, and then jump a significant time (forwards or back) when you add the new NTP source.

The impact would be limited to sources which use the current index time(hopefully not many), but if your clocks were out by more than a few seconds (with reference to one another) I think you would already likely know about it with all sorts of other issues already manifesting.

Maintenance mode would not give you any real benefit for this change, unless you wanted to restart your peers as part of the process, in which case, use MM before you restart each IDX.

If my comment helps, please give it a thumbs up!
0 Karma

yossefn
Path Finder

hi @nickhillscpl, thanks for detailed answer.

Basically I wanted to specify the NTP servers because we're going to change our time in an hour forward this weekend, so I have to make sure that all the servers will get that change.
You right, the differences between the servers wasn't such a big, it's just because the time change.

Anyway, I did the change with the "Maintenance mode" just to be in the safe side. It all looks good now.
Thanks.

0 Karma

nickhills
Ultra Champion

Glad it worked for you, If you're happy, please accept my answer so others can easily see it in the future!
All the best!

If my comment helps, please give it a thumbs up!
0 Karma

yossefn
Path Finder
  1. On CM > "Splunk enable maintenance-mode"
  2. Change NTP on CM
  3. Change NTP on IDXs
  4. On CM > "Splunk disable maintenance-mode"
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...