How do these commands affect an RF=1 situation and rolling upgrade

[PickleRick]

As I wrote few times already I have in my care a relatively strange environment - a quite big installation with RF=1. Yes, I know I don't have data resilence and high availability - the customers knew it and accepted at the start of the project.

But since we're approaching the upgrade and as I'm reading the upgrade instructions, some questions pop up.

The normal procedure includes rolling upgrade of cluster member nodes. The rolling upgrade starts with

splunk upgrade-init cluster-peers 

and ends with

splunk upgrade-finalize cluster-peers

(or proper calls to REST endpoints).

Question is - what does those two commands really do and how it affects the RF=1 situation? As I asked before - it's pointless to put my cluster in maintenance mode and there is no bucket rebalancing after offline/online because there is nothing to rebalance.

So do I have to bother with all this or can I simply take the indexers down one by one, upgrade and start them up again? Yes, I know I won't have full search capacity during the indexer's downtime - it's obvious that if the data is not there I can't search it and my searches would be incomplete. The customers knows it and we'll schedule a "partial downtime".

What do you think?

[somesoni2 · Accepted solution]

It actually doesn’t really matter if you use rolling-upgrade or regular upgrade (one by one OR all at once) since your RF is 1. You’ll have searches will get affected (which is acceptable) so you can do all at once approach as well so minimize the change window. https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Upgradeacluster#Upgrade_all_peer_nodes_in...

[PickleRick]

I can't do all at once due to the volume of input data. If I take one indexer down HF's will fall back to the remaining ones and I shouldn't lose any data during the process.

So if I understand correctly, I should just simply upgrade master first, then search-heads, then indexers one by one and that's it, right?

[somesoni2]

That's correct. Just regular upgrade works (tested).

[PickleRick]

Thank you!