Splunk Enterprise

Update a two-site indexer cluster: to rock or to roll?

vgrote
Path Finder

Hi,

the documentation I found details the update of a two-site cluster in "site-by-site" fashion, which is solid as a rock. We normally go that way, yet w/o taking down one site's the peers at once but by updating them one by none.

And there is a description of a rolling update, where I did not find any mention of multi-site clusters.

I tried a combination of both by rollingly updating one site and then the other, which at the end of the day did not speed up things very much, I still had to wait in the middle for the cluster to recover and become green again.

Did I miss a description of the rolling update of a multi-site indexer cluster?

What would be the benefit?

And what's the difference anyway between going into maintenance mode and a rolling update?

Thanks in advance

Volkmar

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...