Splunk Enterprise

Splunk server OS patching

nawazns5038
Builder

Hi ,

I wish to patch the Linux OS for all the Splunk servers (including search heads, indexers etc). There are a lot of instances.
IS there any specific procedure to be followed or just have to be patched one by one.
Splunk version 6.5.3

Thanks

0 Karma

woodcock
Esteemed Legend

You should not have to interrupt the splunk or OS core services at all to upgrade, but it depends on your distribution. It could be as simple as yum upgrade wait, test, move to the next server, and so on.

0 Karma

nawazns5038
Builder

how about reboot after that. yum upgrade requires a reboot for sure in order to take effect of full updates.

Can we reboot multiple Splunk indexers at least at once or should it only be individual ?

0 Karma

woodcock
Esteemed Legend

If you are clustered, you can do a rolling restart from the CLI. Otherwise, any indexer reboot is an outage so just do them all at once.

0 Karma

nawazns5038
Builder

can we offline two to three splunk instances and upgrade the OS at once ??
Or is it mandatory to offline only one instance at a time ??

0 Karma

woodcock
Esteemed Legend

So what did you end up doing?

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...