Splunk Upgrade 7.1.4 to 7.2.10 : Multisite

[samadmemon]

Hi All,

We are planning for Splunk upgrade from version 7.1.4 to 7.2.10 . We have multisite cluster environment : 

Below are the components : 

1. 3 indexers - Site 1 (Clustered with Site 2 indexers)

2. 1 LM - Site 1

3. 1 CM - Site 1 

4. 2 SH's - Site 1 (Clustered with site 2 SH)

5. 1 deployer - Site 1

6. 1 SH (Standalone) - Site 1 

7. 3 Indexers - Site 2 

8. 1 SH (Clustered with Site 1 SH) - Site 2 

9. 1 SH (Standalone) - Site 2 

We are planning to use the below sequence for the upgrade :

Upgrade the LM (Site 1)

Upgrade the CM 

Upgrade the Search Heads ( Cluster)

Upgrade the Deployer

Upgrade the standalone SH's

Put the CM in maintenance mode 

Upgrade the Indexers ( Peers)  ( Site 1 then Site 2)

Disable the maintenance mode 

Could you please advise if the sequence is correct or is there any other sequence that needs to be followed for upgrade. 

[scelikok · Accepted solution]

Hi @samadmemon,

Sequence seems correct only you should put a step after upgrading peers on Site1.  After upgrading Site peers, you should disable maintenance mode and wait for cluster RF an SF states becomes valid. 

Put the CM in maintenance mode 

Upgrade the Indexers ( Peers)  ( Site 1 )

Disable the maintenance mode 

Wait until both the search factor and replication factor are met.

Enable the maintenance mode 

Upgrade the Indexers ( Peers)  ( Site 2 )

Disable the maintenance mode 

Wait until both the search factor and replication factor are met.

Done!!!

Since 7.2.10 version will be end of support soon at April 30, 2021, it is better upgrading to more recent version? 

If this reply helps you an upvote is appreciated.