Getting Data In

Have an query while doing splunk up gradation from 6.2 to 6.5

lksridhar
Explorer

Hi Folks,

I have read out the splunk document for Upgrade a 6.x indexer cluster to a later version of 6.x , In the document they mention the below steps to perform the up gradation.

  1. Stop the master.

  2. Stop all the peers and search heads.

When bringing down the peers, use the splunk stop command, not splunk offline.

  1. Upgrade the master node, following the normal procedure for any Splunk Enterprise upgrade, as described in How to upgrade Splunk Enterprise in the Installation Manual. Do not upgrade the peers yet.

  2. Start the master, accepting all prompts, if it is not already running.

  3. Run splunk enable maintenance-mode on the master. To confirm that the master is in maintenance mode, run splunk show maintenance-mode. This step prevents unnecessary bucket fix-ups. See Use maintenance mode.

  4. Upgrade the peer nodes and search heads, following the normal procedure for any Splunk Enterprise upgrade, as described in How to upgrade Splunk Enterprise in the Installation Manual.

If the search heads in the indexer cluster are members of a search head cluster, see Upgrade a search head cluster.

  1. Start the peer nodes and search heads, if they are not already running.

  2. Run splunk disable maintenance-mode on the master. To confirm that the master is not in maintenance mode, run splunk show maintenance-mode.

If we stop the all the indexer at a one time, will get the data loss.

Thanks,
Sridhar

Tags (3)
0 Karma

FrankVl
Ultra Champion

With default configuration on your forwarders, that will be very limited right?

You'd need to enable appropriately sized persistent queues to allow for the amount of downtime that you would need for such an upgrade procedure, right? And such persistent queues only work for certain input types as well.

But I guess unless you have a multisite indexer cluster, there is no way to do an upgrade without indeed having your whole cluster down temporarily. Which depending on the configuration of your data sources, potential aggregators like syslog servers and your forwarders, that could cause data loss.

@lksridhar: what exactly is your question though?

0 Karma

lksridhar
Explorer

Thanks richgalloway and frankVi for your answer, now i got clear info,

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your forwarders should buffer input while the indexers are down.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...