Developing for Splunk Enterprise

Rolling restart of Splunk service on linux multiple servers.

arunsunny
Path Finder

Hi

I am looking for a script to perform the rolling restart of Splunk service on multiple servers from the Centralised server where it has ssh access to the slave servers.

Is anybody have the script?

Thanks,
Arun Sunny

Labels (1)
0 Karma

BainM
Communicator

Hello-
We need some more info. What version of Splunk, what server type (Searchhead standalone, cluster searchheads, indexer cluster, etc).

If any of this is clustered, and it's the 7.x or 8.x version, you can initiate a SHC rolling restart right from within Splunkweb on any of the SHC members - Settings - Search Head Clustering, then look for the "Begin Rolling Restart" button on the top right.

If it's a peer cluster, you will want to run the rolling restart command from any peer or the ClusterMaster.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Userollingrestart

This is the easiest and smoothest way to do a Rolling Restart. I would not use any scripts.

Hope this helps,
Mike

0 Karma

arunsunny
Path Finder

I am looking at the rolling restart of the endpoint agents. (It's Just a Splunk universal forwarder agent installed on all the endpoints)

0 Karma

badrinath_itrs
Communicator

Hello, is the UF managed via Deployment servers ? If yes, you can restart them when you push a change from Deployment server using restart flag.

If they are not managed by Deployment server, then you can use puppet or chef or ansible depending on your environment to restart UF.

0 Karma

arunsunny
Path Finder

Yes, it's all managed by DS but I do not want to restart them at the same time. So I am looking for a script where it does the rolling restart in this case.

0 Karma

soumyasaha25
Contributor

you can create custom server classes and push your configs one at a time (individually for each server class).

0 Karma

arunsunny
Path Finder

@soumyasaha25 - I have around 50 endpoints so I can not create 50 serverclass. I am looking for a better approach to push the configs.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!