Splunk Enterprise Security

reboot splunk instance after OS patching

rashid47010
Communicator

link text

We patch our OS last week and OS admin advise us to reboto the Indexers once. we have multistie scenerios. (6+6).

Please suggest a best method to reboot OS without effecting index searching capability.

0 Karma
1 Solution

lakshman239
SplunkTrust
SplunkTrust

I would suggest you perform the proposed activity on a test server [ can be single instance, if you don't have a cluster setup] which same OS level patches/versions and same version of splunk instance as prod. This can prove that the reboot of the OS works fine and the splunk starts up clean.
- Ensure your instances are setup boot enable splunk
- watch for any errors in splunkd.logs and python logs related to OS and splunk apps/add-ons on your instance
- If you are happy, you can select a quite period [ out of office hours, when the load and incoming data is minimal], put the master in maintenance mode, restart/reboot the cluster master and ensure it comes up and all peer nodes connect successfully.
- take out each search peer on to a maintenance mode or offline (ensure they are are in maintenance mode) and reboot and re-enable them
- between each peer node reboot, ensure the nodes

You may also want to refer to https://answers.splunk.com/answers/352976/what-is-the-correct-procedure-to-patch-the-os-and.html
https://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Upgradeacluster#Upgrade_to_a_maintenance_...

View solution in original post

0 Karma

lakshman239
SplunkTrust
SplunkTrust

I would suggest you perform the proposed activity on a test server [ can be single instance, if you don't have a cluster setup] which same OS level patches/versions and same version of splunk instance as prod. This can prove that the reboot of the OS works fine and the splunk starts up clean.
- Ensure your instances are setup boot enable splunk
- watch for any errors in splunkd.logs and python logs related to OS and splunk apps/add-ons on your instance
- If you are happy, you can select a quite period [ out of office hours, when the load and incoming data is minimal], put the master in maintenance mode, restart/reboot the cluster master and ensure it comes up and all peer nodes connect successfully.
- take out each search peer on to a maintenance mode or offline (ensure they are are in maintenance mode) and reboot and re-enable them
- between each peer node reboot, ensure the nodes

You may also want to refer to https://answers.splunk.com/answers/352976/what-is-the-correct-procedure-to-patch-the-os-and.html
https://docs.splunk.com/Documentation/Splunk/7.1.0/Indexer/Upgradeacluster#Upgrade_to_a_maintenance_...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...