- Splunk Answers
- :
- Splunk Administration
- :
- Installation
- :
- Re: Is it possible during an upgrade to postpone t...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
During the upgrade to 7.1.7 we had a couple of challenges and some are mentioned at Large amount of buckets that need to be fixed after the upgrade?
So, let's say, we make the (next) upgrade on Thursday night.
Is it possible to "postpone" the replication process, let's say until Friday afternoon?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Gorgeous @skalliger.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@ddrillic, don't think this is a good idea it's too risky for the cluster as any indexer loss or even restart could affect the state of your cluster. Postponing the replication by enabling maintenance mode would be similar to disabling your entire environment.
I would say plan ahead and make sure you upgrade when you're ready to take the replication load on the network and Splunk infrastructure.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Depends on the amount of buckets. But I'd probably just let the fixup finish before doing another upgrade.
Skalli
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@skalliger and as I said, you should not use maintenance mode for "postponing" replication. This just breaks everything. Maintenance mode is not made to be a long term state.
Only upgrade when you know it's ok to have the replication going. If it's not then wait till when it is.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From the SE -
I mean… why would you want to do that? You’d only be building up more back pressure.
The behavior you saw after upgrade is a positive thing. Without this extra work by the indexers your data is unsafe and easy to lose forever.
If you want to tweak the behavior to make it more manageable check out workload management in 7.2.x and above.
If you didn’t do a site-by-site upgrade (I thought you did?), site-by-site would reduce the fixup count significantly.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah, exactly. Better just just upgrade when you're sure that you can get the replication going and not try to stall that process. You'll only end up with way more fixups than when you started.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Absolutely @DavidHourani - we'll throw this idea out the window ; -)
Updated Team Landing Page in Splunk Observability
New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...
Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...
