Splunk Enterprise

Update a two-site indexer cluster: to rock or to roll?

vgrote
Path Finder

Hi,

the documentation I found details the update of a two-site cluster in "site-by-site" fashion, which is solid as a rock. We normally go that way, yet w/o taking down one site's the peers at once but by updating them one by none.

And there is a description of a rolling update, where I did not find any mention of multi-site clusters.

I tried a combination of both by rollingly updating one site and then the other, which at the end of the day did not speed up things very much, I still had to wait in the middle for the cluster to recover and become green again.

Did I miss a description of the rolling update of a multi-site indexer cluster?

What would be the benefit?

And what's the difference anyway between going into maintenance mode and a rolling update?

Thanks in advance

Volkmar

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...