Splunk Enterprise

Update a two-site indexer cluster: to rock or to roll?

vgrote
Path Finder

Hi,

the documentation I found details the update of a two-site cluster in "site-by-site" fashion, which is solid as a rock. We normally go that way, yet w/o taking down one site's the peers at once but by updating them one by none.

And there is a description of a rolling update, where I did not find any mention of multi-site clusters.

I tried a combination of both by rollingly updating one site and then the other, which at the end of the day did not speed up things very much, I still had to wait in the middle for the cluster to recover and become green again.

Did I miss a description of the rolling update of a multi-site indexer cluster?

What would be the benefit?

And what's the difference anyway between going into maintenance mode and a rolling update?

Thanks in advance

Volkmar

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...