Knowledge Management

Important fix for 9.1.4/9.2.1

hrawat
Splunk Employee
Splunk Employee

https://docs.splunk.com/Documentation/Splunk/9.2.1/ReleaseNotes/Fixedissues
https://docs.splunk.com/Documentation/Splunk/9.1.4/ReleaseNotes/Fixedissues

One  customer reported a very interesting issue with graceful splunk restart.

Event missing during a graceful restart/rolling restart(splunk stop gracefully finished). useACK=true is an option but that ideally must be applied if splunk stop timed-out. This has been an issue for so many years.

This is important where config changes are pushed frequently, thus triggering frequent indexer/HF/IF restart.

The issue is fixed by 9.1.4/9.2.1

 

TcpInputProcessor not able to drain splunktcpin queue during graceful shutdown

 

How to detect if it's applicable for your deployment?
Check splunkd.log for 

WARN  TcpInputProc - Could not process data received from network. Aborting due to shutdown


Also from metrics.log see
https://community.splunk.com/t5/Knowledge-Management/During-indexer-restart-indexer-cluster-rolling-...

Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...