Splunk Enterprise

Update a two-site indexer cluster: to rock or to roll?

vgrote
Path Finder

Hi,

the documentation I found details the update of a two-site cluster in "site-by-site" fashion, which is solid as a rock. We normally go that way, yet w/o taking down one site's the peers at once but by updating them one by none.

And there is a description of a rolling update, where I did not find any mention of multi-site clusters.

I tried a combination of both by rollingly updating one site and then the other, which at the end of the day did not speed up things very much, I still had to wait in the middle for the cluster to recover and become green again.

Did I miss a description of the rolling update of a multi-site indexer cluster?

What would be the benefit?

And what's the difference anyway between going into maintenance mode and a rolling update?

Thanks in advance

Volkmar

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...