Splunk Enterprise

test of rolling-restart using rest api

schose
Builder

Hi all,

We want to test if a cluster bundle on cluster manager needs to restart the cluster peers using the REST API. 

In the first step we run a POST against:

https://CLM:8089/services/cluster/manager/control/default/validate_bundle?output_mode=json

check-restart=true in body

and check for json.entry[0].content.checksum to get the checksum of the new bundle. If there is no checksum, there is no new bundle.

Second we check the checksum against GET:
https://CLM:8089/services/cluster/manager/info?output_mode=json

json.entry[0].content.last_validated_bundle.checksum
json.entry[0].content.last_dry_run_bundle.checksum


to verify if the bundle check and test of the restart is completed and consider

json.entry[0].content.last_check_restart_bundle_result

if the restart is nessary or not. Unfurtunatly we see that the value of  json.entry[0].content.last_check_restart_bundle_result changes, even if last_dry_run_bundle.checksum and last_dry_run_bundle.checksum are set to the correct values.  

to make a long story short we see that the red value is changing, while green is not changing. which is unexprected for us.

Bildschirmfoto 2025-04-22 um 20.25.13.png

tested against v9.2.5 and v9.4.1. At the moment is looks like a timing issue for me and i want to avoid sleep() code. 
 
Is there a more solid way to check if restart is necessary or not? 

best regards,
 
Andreas

 



Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...