Splunk Enterprise

Splunk Smartstore and peers down

jariw
Path Finder

L.s.,

We are at the beginning of a migration to Smartstore. We are reading/ following Migrate existing data on an indexer cluster to SmartStore - Splunk Documentation .

One thing is worrying to us.. bullet 7 in the "Run the migration on the indexer cluster". It says "Stop all the peer nodes."... not so nice on a production cluster.

Is this really necessary? Isn't it possible to do ithis part with the deployment from the MC? So not all peers goes down at the same time (and losing data).

Thanks in advance for the answer.

 

Jari

 

Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @jariw,

In my experience maintenance-mode and stopping all peer nodes is not necessary.

You will already push the configuration from Cluster Manager. Before pushing new configuration, do not forget testing your new indexes.conf configuration on a standalone instance and repFactor=auto setting (as said  on item 8.a).

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

jariw
Path Finder

Thanks, this is what i was hoping for.

So the manual is in this case only for safety i suppose. Already tested it on a development environment and then questioned myself why taking the peers down.

Will continue testing.

 

greetz

Jari

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @jariw,

In my experience maintenance-mode and stopping all peer nodes is not necessary.

You will already push the configuration from Cluster Manager. Before pushing new configuration, do not forget testing your new indexes.conf configuration on a standalone instance and repFactor=auto setting (as said  on item 8.a).

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...