Splunk Enterprise

test of rolling-restart using rest api

schose
Builder

Hi all,

We want to test if a cluster bundle on cluster manager needs to restart the cluster peers using the REST API. 

In the first step we run a POST against:

https://CLM:8089/services/cluster/manager/control/default/validate_bundle?output_mode=json

check-restart=true in body

and check for json.entry[0].content.checksum to get the checksum of the new bundle. If there is no checksum, there is no new bundle.

Second we check the checksum against GET:
https://CLM:8089/services/cluster/manager/info?output_mode=json

json.entry[0].content.last_validated_bundle.checksum
json.entry[0].content.last_dry_run_bundle.checksum


to verify if the bundle check and test of the restart is completed and consider

json.entry[0].content.last_check_restart_bundle_result

if the restart is nessary or not. Unfurtunatly we see that the value of  json.entry[0].content.last_check_restart_bundle_result changes, even if last_dry_run_bundle.checksum and last_dry_run_bundle.checksum are set to the correct values.  

to make a long story short we see that the red value is changing, while green is not changing. which is unexprected for us.

Bildschirmfoto 2025-04-22 um 20.25.13.png

tested against v9.2.5 and v9.4.1. At the moment is looks like a timing issue for me and i want to avoid sleep() code. 
 
Is there a more solid way to check if restart is necessary or not? 

best regards,
 
Andreas

 



Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...