Getting Data In

What is the difference between maintenance mode versus off-line during a Linux patch?

Ultra Champion

We have a Linux patch which requires a server reboot scheduled tonight for one out of the ten indexers. The patch would be applied at night at some point.

We wonder whether we should put the entire cluster on maintenance mode or maybe take this specific indexer off-line for the whole night.

0 Karma

Ultra Champion
0 Karma

Ultra Champion

Our sales engineer said -

  • Well don't put the entire cluster in maintenance mode, that would cause an enormous amount of load when you brought it out of maintenance mode, and makes your new data since the maintenance mode went into effect very unsafe.

No, offline that server nicely and add it back at your leisure.

0 Karma

Influencer

Well as the docs say,

Maintenance mode halts most bucket fixup activity and prevents frequent rolling of hot buckets.

https://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Usemaintenancemode

What will happen when you put that peer offline is that all the hot buckets will be rolled to warm as a result of the splunk stop command.

If you do this very often, you may end up having very small buckets in your environment, which is not great as Splunk would need to check several buckets for the data someone has searched instead of few.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!