Splunk Enterprise

test of rolling-restart using rest api

schose
Builder

Hi all,

We want to test if a cluster bundle on cluster manager needs to restart the cluster peers using the REST API. 

In the first step we run a POST against:

https://CLM:8089/services/cluster/manager/control/default/validate_bundle?output_mode=json

check-restart=true in body

and check for json.entry[0].content.checksum to get the checksum of the new bundle. If there is no checksum, there is no new bundle.

Second we check the checksum against GET:
https://CLM:8089/services/cluster/manager/info?output_mode=json

json.entry[0].content.last_validated_bundle.checksum
json.entry[0].content.last_dry_run_bundle.checksum


to verify if the bundle check and test of the restart is completed and consider

json.entry[0].content.last_check_restart_bundle_result

if the restart is nessary or not. Unfurtunatly we see that the value of  json.entry[0].content.last_check_restart_bundle_result changes, even if last_dry_run_bundle.checksum and last_dry_run_bundle.checksum are set to the correct values.  

to make a long story short we see that the red value is changing, while green is not changing. which is unexprected for us.

Bildschirmfoto 2025-04-22 um 20.25.13.png

tested against v9.2.5 and v9.4.1. At the moment is looks like a timing issue for me and i want to avoid sleep() code. 
 
Is there a more solid way to check if restart is necessary or not? 

best regards,
 
Andreas

 



Labels (1)
Tags (2)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...