We are planning for Splunk upgrade from version 7.1.4 to 7.2.10 . We have multisite cluster environment :
Below are the components :
1. 3 indexers - Site 1 (Clustered with Site 2 indexers)
2. 1 LM - Site 1
3. 1 CM - Site 1
4. 2 SH's - Site 1 (Clustered with site 2 SH)
5. 1 deployer - Site 1
6. 1 SH (Standalone) - Site 1
7. 3 Indexers - Site 2
8. 1 SH (Clustered with Site 1 SH) - Site 2
9. 1 SH (Standalone) - Site 2
We are planning to use the below sequence for the upgrade :
Upgrade the LM (Site 1)
Upgrade the CM
Upgrade the Search Heads ( Cluster)
Upgrade the Deployer
Upgrade the standalone SH's
Put the CM in maintenance mode
Upgrade the Indexers ( Peers) ( Site 1 then Site 2)
Disable the maintenance mode
Could you please advise if the sequence is correct or is there any other sequence that needs to be followed for upgrade.
Sequence seems correct only you should put a step after upgrading peers on Site1. After upgrading Site peers, you should disable maintenance mode and wait for cluster RF an SF states becomes valid.
Upgrade the Indexers ( Peers) ( Site 1 )
Wait until both the search factor and replication factor are met.
Enable the maintenance mode
Upgrade the Indexers ( Peers) ( Site 2 )
Since 7.2.10 version will be end of support soon at April 30, 2021, it is better upgrading to more recent version?
If this reply helps you an upvote is appreciated.
View solution in original post