Splunk Dev

Script for rolling restart of Splunk service on linux multiple servers?

arunsunny
Path Finder

Hi

I am looking for a script to perform the rolling restart of Splunk service on multiple servers from the Centralised server where it has ssh access to the slave servers.

Is anybody have the script?

Thanks,
Arun Sunny

Labels (1)
0 Karma

BainM
Communicator

Hello-
We need some more info. What version of Splunk, what server type (Searchhead standalone, cluster searchheads, indexer cluster, etc).

If any of this is clustered, and it's the 7.x or 8.x version, you can initiate a SHC rolling restart right from within Splunkweb on any of the SHC members - Settings - Search Head Clustering, then look for the "Begin Rolling Restart" button on the top right.

If it's a peer cluster, you will want to run the rolling restart command from any peer or the ClusterMaster.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Userollingrestart

This is the easiest and smoothest way to do a Rolling Restart. I would not use any scripts.

Hope this helps,
Mike

0 Karma

arunsunny
Path Finder

I am looking at the rolling restart of the endpoint agents. (It's Just a Splunk universal forwarder agent installed on all the endpoints)

0 Karma

badrinath_itrs
Communicator

Hello, is the UF managed via Deployment servers ? If yes, you can restart them when you push a change from Deployment server using restart flag.

If they are not managed by Deployment server, then you can use puppet or chef or ansible depending on your environment to restart UF.

0 Karma

arunsunny
Path Finder

Yes, it's all managed by DS but I do not want to restart them at the same time. So I am looking for a script where it does the rolling restart in this case.

0 Karma

soumyasaha25
Contributor

you can create custom server classes and push your configs one at a time (individually for each server class).

0 Karma

arunsunny
Path Finder

@soumyasaha25 - I have around 50 endpoints so I can not create 50 serverclass. I am looking for a better approach to push the configs.

0 Karma

Skerilyo
Loves-to-Learn

Hi, did you find any viable solution to this problem ?

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...