Splunk Enterprise

Rolling restart hung on "Reassigning primaries"


Hello, we have an indexer cluster of two peers with replication and serach factors set to 2.

The latest rolling restart is currently not progressing for four hours, the second peer is in status "Reassigning primaries".


Four hours ago initiated a searchable rolling restart from master server's GUI. The first indexer went down for restart and did not return to operation for10 minutes. When logging in under root and then running "su splunk; /opt/splunk/bin/splunk status" saw the following:

   splunkd 26239 was not running.
   Stopping splunk helpers...

Repeating "/opt/splunk/bin/splunk status" returned the output:
   splunkd is not running.

We then started Splunk application by running "/opt/splunk/bin/splunk status". The server went up and the peer joined the cluster.

Starting from that moment the second peer changed status to "Reassigning primaries" and nothing happens up to this moment.

The cluster is in maintenance mode, no fixup tasks are performed, currently have 6k+ of them pending. Search and replication factors are not met for almost all production indexes, 8 of them being not fully searchable.


How can we finish the rolling restart or at least cancel it?

Thank you for your time and assistance!

Labels (2)
0 Karma

Loves-to-Learn Lots

Please let me know is there an update on this problem?

I am facing the same issue. Thanks

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.