Splunk Enterprise Security

reboot splunk instance after OS patching

rashid47010
Communicator

link text

We patch our OS last week and OS admin advise us to reboto the Indexers once. we have multistie scenerios. (6+6).

Please suggest a best method to reboot OS without effecting index searching capability.

0 Karma
1 Solution

lakshman239
Influencer

I would suggest you perform the proposed activity on a test server [ can be single instance, if you don't have a cluster setup] which same OS level patches/versions and same version of splunk instance as prod. This can prove that the reboot of the OS works fine and the splunk starts up clean.
- Ensure your instances are setup boot enable splunk
- watch for any errors in splunkd.logs and python logs related to OS and splunk apps/add-ons on your instance
- If you are happy, you can select a quite period [ out of office hours, when the load and incoming data is minimal], put the master in maintenance mode, restart/reboot the cluster master and ensure it comes up and all peer nodes connect successfully.
- take out each search peer on to a maintenance mode or offline (ensure they are are in maintenance mode) and reboot and re-enable them
- between each peer node reboot, ensure the nodes

You may also want to refer to https://answers.splunk.com/answers/352976/what-is-the-correct-procedure-to-patch-the-os-and.html
https://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Upgradeacluster#Upgrade_to_a_maintenance_...

View solution in original post

0 Karma

lakshman239
Influencer

I would suggest you perform the proposed activity on a test server [ can be single instance, if you don't have a cluster setup] which same OS level patches/versions and same version of splunk instance as prod. This can prove that the reboot of the OS works fine and the splunk starts up clean.
- Ensure your instances are setup boot enable splunk
- watch for any errors in splunkd.logs and python logs related to OS and splunk apps/add-ons on your instance
- If you are happy, you can select a quite period [ out of office hours, when the load and incoming data is minimal], put the master in maintenance mode, restart/reboot the cluster master and ensure it comes up and all peer nodes connect successfully.
- take out each search peer on to a maintenance mode or offline (ensure they are are in maintenance mode) and reboot and re-enable them
- between each peer node reboot, ensure the nodes

You may also want to refer to https://answers.splunk.com/answers/352976/what-is-the-correct-procedure-to-patch-the-os-and.html
https://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Upgradeacluster#Upgrade_to_a_maintenance_...

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...