Splunk Enterprise

test of rolling-restart using rest api

schose
Builder

Hi all,

We want to test if a cluster bundle on cluster manager needs to restart the cluster peers using the REST API. 

In the first step we run a POST against:

https://CLM:8089/services/cluster/manager/control/default/validate_bundle?output_mode=json

check-restart=true in body

and check for json.entry[0].content.checksum to get the checksum of the new bundle. If there is no checksum, there is no new bundle.

Second we check the checksum against GET:
https://CLM:8089/services/cluster/manager/info?output_mode=json

json.entry[0].content.last_validated_bundle.checksum
json.entry[0].content.last_dry_run_bundle.checksum


to verify if the bundle check and test of the restart is completed and consider

json.entry[0].content.last_check_restart_bundle_result

if the restart is nessary or not. Unfurtunatly we see that the value of  json.entry[0].content.last_check_restart_bundle_result changes, even if last_dry_run_bundle.checksum and last_dry_run_bundle.checksum are set to the correct values.  

to make a long story short we see that the red value is changing, while green is not changing. which is unexprected for us.

Bildschirmfoto 2025-04-22 um 20.25.13.png

tested against v9.2.5 and v9.4.1. At the moment is looks like a timing issue for me and i want to avoid sleep() code. 
 
Is there a more solid way to check if restart is necessary or not? 

best regards,
 
Andreas

 



Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...