During the upgrade to 7.1.7 we had a couple of challenges and some are mentioned at Large amount of buckets that need to be fixed after the upgrade?
So, let's say, we make the (next) upgrade on Thursday night.
Is it possible to "postpone" the replication process, let's say until Friday afternoon?
@ddrillic, don't think this is a good idea it's too risky for the cluster as any indexer loss or even restart could affect the state of your cluster. Postponing the replication by enabling maintenance mode would be similar to disabling your entire environment.
I would say plan ahead and make sure you upgrade when you're ready to take the replication load on the network and Splunk infrastructure.
Depends on the amount of buckets. But I'd probably just let the fixup finish before doing another upgrade.
@skalliger and as I said, you should not use maintenance mode for "postponing" replication. This just breaks everything. Maintenance mode is not made to be a long term state.
Only upgrade when you know it's ok to have the replication going. If it's not then wait till when it is.
From the SE -
I mean… why would you want to do that? You’d only be building up more back pressure.
The behavior you saw after upgrade is a positive thing. Without this extra work by the indexers your data is unsafe and easy to lose forever.
If you want to tweak the behavior to make it more manageable check out workload management in 7.2.x and above.
If you didn’t do a site-by-site upgrade (I thought you did?), site-by-site would reduce the fixup count significantly.
Yeah, exactly. Better just just upgrade when you're sure that you can get the replication going and not try to stall that process. You'll only end up with way more fixups than when you started.