Getting Data In

What is the difference between maintenance mode versus off-line during a Linux patch?

ddrillic
Ultra Champion

We have a Linux patch which requires a server reboot scheduled tonight for one out of the ten indexers. The patch would be applied at night at some point.

We wonder whether we should put the entire cluster on maintenance mode or maybe take this specific indexer off-line for the whole night.

0 Karma

ddrillic
Ultra Champion
0 Karma

ddrillic
Ultra Champion

Our sales engineer said -

  • Well don't put the entire cluster in maintenance mode, that would cause an enormous amount of load when you brought it out of maintenance mode, and makes your new data since the maintenance mode went into effect very unsafe.

No, offline that server nicely and add it back at your leisure.

0 Karma

tiagofbmm
Influencer

Well as the docs say,

Maintenance mode halts most bucket fixup activity and prevents frequent rolling of hot buckets.

https://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Usemaintenancemode

What will happen when you put that peer offline is that all the hot buckets will be rolled to warm as a result of the splunk stop command.

If you do this very often, you may end up having very small buckets in your environment, which is not great as Splunk would need to check several buckets for the data someone has searched instead of few.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...