Rolling upgrade vs Maintenance mode commands on cluster manager and indexers

[rickymckenzie10]

I’ve read the documentation on these commands, executed both in a dev environment and observed the behavior.

My interpretation of the commands is that they are the same.

Does someone want to take a stab, and try to better explain them from your own perspective 🙂

Please don't point me or reference to any Splunk docs, I've read them already and still can't see when is the best use case to use these. I want to read you're opinion!

What is the main difference between these two commands?

1. splunk enable maintenance-mode
2. splunk upgrade-init cluster-peers

Here is the scene: I will be upgrading a cluster of splunk cluster manager and their peers.

1. Cluster manager
2. Indexers

I don't want to initiate a bucket fixup on each indexer (10 peers * 10TB on each peer).

Which one best fits/servers my use case above?

[richgalloway]

Enabling maintenance mode simply tells the Cluster Manager to not bother doing bucket fix-ups.  Nothing happens on the indexers themselves.

The upgrade-init command starts a rolling restart of the indexers after setting maintenance mode.

[SanjayReddy · Accepted solution]

Hi @rickymckenzie10 

for your requirement, I would suggest to go for option 2 for upgarde

let me explain difference as per my understanding 

in most of the terms both works same but some differences.

with Maintenance mode  you are telling cluster master that 
some activity will happen on the indexers, it can be stopping splunk on indexer, rebooting the server , upgrading Splunk .

With Maintenance mode enabled bucket replication will not happen in the entire cluster 
once maintenance mode disabled, bucket fixup tasks will complete.

With Rolling upgrade command , manager node understands that its upgrade of cluster and with running Rolling upgrade command also enables maintenance mode and tries to minimize the impact to searches.