Splunk Shutdown and or restart process

[tonytharp]

My Splunk specs are:

Searchhead & Monitoring Console on one server

3 indexers on separate servers

Cluster Manager on a separate server

License Manager & Deployment Server on one server

What is the proper process to shut everything down and bring everything back up for a power outage?

[azteksites]

I would try to mirror the upgrade best practices to bring down splunk servers based on their role with the exception of bringing down the cluster manager and deployment server last.

1. search head
2. indexers (sequentially)
3. CM
4. DS

Reverse order to bring systems back online. Ideally, the monitoring console would be installed on the manager node as the last device to come offline and first to come online monitor the state of the cluster during shutdown/boot.

I HIGHLY RECOMMEND getting a second opinion on this from support if you can. I haven't had to go through this process yet personally, this is just my thought process. Hope this helps.