Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Installation
- :
- Re: Splunk 4.3 upgrade question - disable?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In the instructions here:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Upgradeyourdistributedenvironment
In the area where you are upgrading a distributed environment with multiple indexers and non-pooled search heads, it states that in step #4 you should:
- Disable and upgrade one of the search heads. Do not allow it to restart.
What exactly do they mean by "disable"? Stop splunk?
The search head we are updating is our main search head. It's the main console everyone logs into to use splunk. It searches 3 other main indexers. It also indexes data itself. I'm assuming they mean to stop splunk?
Can anyone clarify what "disable" means?
If these instructions are for non-pooled search heads, I can't see how disable would mean disabling it from being searched on by the rest of the pool if it's a non-pooled search head.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
$SPLUNK_HOME/bin/splunk disable boot-start
$SPLUNK_HOME/bin/splunk stop
Then do your upgrade(s).
$SPLUNK_HOME/bin/splunk enable boot-start
$SPLUNK_HOME/bin/splunk start
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
$SPLUNK_HOME/bin/splunk disable boot-start
$SPLUNK_HOME/bin/splunk stop
Then do your upgrade(s).
$SPLUNK_HOME/bin/splunk enable boot-start
$SPLUNK_HOME/bin/splunk start
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You're welcome.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you very much
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner
The Data Connection - October 2026
Beyond the Acceleration Zone: Maximizing Your Success with Splunk Customer Experience ...
