Splunk 4.3 upgrade question - disable?

[gnovak]

In the instructions here:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Upgradeyourdistributedenvironment

In the area where you are upgrading a distributed environment with multiple indexers and non-pooled search heads, it states that in step #4 you should:

1. Disable and upgrade one of the search heads. Do not allow it to restart.

What exactly do they mean by "disable"? Stop splunk?

The search head we are updating is our main search head. It's the main console everyone logs into to use splunk. It searches 3 other main indexers. It also indexes data itself. I'm assuming they mean to stop splunk?

Can anyone clarify what "disable" means?

If these instructions are for non-pooled search heads, I can't see how disable would mean disabling it from being searched on by the rest of the pool if it's a non-pooled search head.

[jgedeon120 · Accepted solution]

$SPLUNK_HOME/bin/splunk disable boot-start
$SPLUNK_HOME/bin/splunk stop

Then do your upgrade(s).

$SPLUNK_HOME/bin/splunk enable boot-start
$SPLUNK_HOME/bin/splunk start

[jgedeon120]

You're welcome.

[gnovak]

Thank you very much