Automated splunk offline and enable/disable maintenance-mode for OS updates

[splunkreal]

Hello, in ssh CLI running Redhat linux, how to launch splunk offline on indexers and on splunk manager node, enable or disable maintenance-mode without credentials (it asks for local admin username and password)?

This way we could automate OS updates by properly stop services.

Thanks for your help.

[PickleRick]

Adding to what has already been said - I would not recommend doing OS maintenance without a Splunk admin assist (or at least available on call). It is not OS administrator's area of competence to verify whether Splunk has shut down correctly, started correctly, is working correctly and so on. What if something happens when your environment is in maintenance mode? Will your OS admins be able to handle it properly? I wouldn't expect them to because it's not their job.

[PrewinThomas]

@splunkreal 
As @livehybrid mentioned, You cannot fully bypass Splunk authentication for maintenance‑mode operations. The splunk offline and splunk enable/disable maintenance-mode commands always require
Splunk admin credentials (not Linux root).

To automate, you should use either Splunk auth tokens or a service account with pre‑configured credentials in a script.

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[livehybrid]

Hi @splunkreal 

Just to clarify - Its asking for a Splunk admin authentication, not a local system account. 

You need to enter the user/pass of an admin user in your Splunk instance - alternatively you can pass a Splunk auth token by adding the following to your CLI command

-token <yourToken>

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing