- Community
- :
- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: What is the right order to change NTP setting ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I need to change the NTP settings (in /etc/ntp.conf file) in a clustered environment (3 Indexers in cluster).
Is there some specific order I need to follow to make it in the right way (Maintenance mode maybe), or just to change one by one?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To be honest, if you time is in sync when you make the change, you should be able to do this without any Splunk specific action.
It would only cause you issues if your Splunk indexers are wildly out of sync, and then jump a significant time (forwards or back) when you add the new NTP source.
The impact would be limited to sources which use the current index time(hopefully not many), but if your clocks were out by more than a few seconds (with reference to one another) I think you would already likely know about it with all sorts of other issues already manifesting.
Maintenance mode would not give you any real benefit for this change, unless you wanted to restart your peers as part of the process, in which case, use MM before you restart each IDX.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To be honest, if you time is in sync when you make the change, you should be able to do this without any Splunk specific action.
It would only cause you issues if your Splunk indexers are wildly out of sync, and then jump a significant time (forwards or back) when you add the new NTP source.
The impact would be limited to sources which use the current index time(hopefully not many), but if your clocks were out by more than a few seconds (with reference to one another) I think you would already likely know about it with all sorts of other issues already manifesting.
Maintenance mode would not give you any real benefit for this change, unless you wanted to restart your peers as part of the process, in which case, use MM before you restart each IDX.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @nickhillscpl, thanks for detailed answer.
Basically I wanted to specify the NTP servers because we're going to change our time in an hour forward this weekend, so I have to make sure that all the servers will get that change.
You right, the differences between the servers wasn't such a big, it's just because the time change.
Anyway, I did the change with the "Maintenance mode" just to be in the safe side. It all looks good now.
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad it worked for you, If you're happy, please accept my answer so others can easily see it in the future!
All the best!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- On CM > "Splunk enable maintenance-mode"
- Change NTP on CM
- Change NTP on IDXs
- On CM > "Splunk disable maintenance-mode"
Using Machine Learning for Hunting Security Threats
Observability Newsletter Highlights | March 2023
Security Newsletter Updates | March 2023
