procedure to perform non-rolling upgrade a (Windows) Search Head Cluster - problem with service auto-restart

[sylbaea]

Hello,

I have a 3-node (Windows 2012 R2 based) Search Head Cluster currently connected to a standalone indexer.

I wanted to follow the non-rolling upgrade procedure (anticipating it will be soon connected to a clustered indexer) described here:
http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/UpgradeaSHC

It is specified as step 1 to stop all cluster members, and to only restart them after the upgrade of all nodes.

However:
1. If I simply stop Splunkd Service, the MSI setup does restart the service automatically at the end of the upgrade.
2. If I stop Splunkd Service and temporary change startup type to Disabled, upgrade fails and rollback because setup is not able to start the service.

By the end, the upgrade has worked (I manually stopped again each node after its upgrade) but I have not been able to comply with the "official" non-rolling upgrade procedure.
Is anybody proceeding differently and able to follow the official procedure ?

Regards.

[somesoni2 · Accepted solution]

You can use Command line to upgrade Splunk and specify following flag so that Splunk will not try to start the service after upgarde.

msiexec.exe /i splunk-<...>-x64-release.msi LAUNCHSPLUNK=0 /quiet

LAUNCHSPLUNK=0/1

Description: Use this flag to specify whether or not Splunk should start up automatically on system boot.
Note: If you enable the Splunk Forwarder by using the SPLUNK_APP flag, the installer configures Splunk to start automatically, and ignores this flag.
Default Value: 1 (on)

[sylbaea]

You are right. I forgot about this option.
Thanks a lot for the reminder 🙂