env: Splunk 6.4.1 environment (all linux OS based): 3x index cluster peers 1x cluster master 1x deployer/license master 3x search head cluster peers 2x heavy forwarders pre-checks: https://www.splunk.com/pdfs/technical-briefs/splunk-deploying-vmware-tech-brief.pdf (in particular it references not to use vmware snapshots) <- unsure of date of this document. Question: Are there any definitive guidelines on whether using VMware snapshots is supported for Splunk indexer clusters? This is not likely to be an ongoing requirement but rather on an ad-hoc basis (pre-upgrade for example). Any pointers v.much appreciated. Thx Bry ... View more

Hi environment (all linux OS based): 3x index cluster peers 1x cluster master 1x deployer/license master 3x search head cluster peers 2x heavy forwarders Question: I have been reading the following documentation for upgrading splunk - http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Upgradeacluster - I read from it that it is still not possible to perform rolling upgrades? A shame if that is true, as ELK is still a possible option for us and afaik you can run rolling upgrades on ELK clusters. If it is the case that we cannot at this point do rolling upgrades on our splunk nodes, is there a preferred approach to how we queue data coming in from the heavy forwarders? I have been reading the following documentation relating to forwarders 'wait queue' -http://docs.splunk.com/Documentation/Splunk/6.5.0/Forwarding/Protectagainstlossofin-flightdata - and my thinking is that I could increase the 'readTimeout' in the 'outputs.conf' to some arbitrary figure to cover the cluster upgrade process (will test in a lab first to get expected time). depending that we have enough disk capacity for the 'wait queue' is my thinking ok? Also, does anybody know if splunk are planning to allow for rolling upgrades in the near-future, as i'm sure I wouldn't be the only one seeing this as more than desirable 🙂 Thx Bry ... View more

[env] centos 7, splunk enterprise 6.4.1 4x search heads (-mode searchhead -master_uri cluster_master) [2 heads are set to be decommissioned] 3x clustered index peers (cluster master) <- multi site capable, 1 site live for now 2x heavy forwarders load balanced reverse proxy serving search head pool url access for users question: i am in the process of researching implementing a search head cluster in the current model (see [env] above) and have been looking at the following documentation; http://docs.splunk.com/Documentation/Splunk/6.5.0/DistSearch/SHCdeploymentoverview 1: am i able to use 3 search head nodes that are already pointing the the back-end index cluster and then just run the commands to add these members to the search head cluster (and elect a captain) <- also add the deployer role to the index cluster master? 2: if no to No.1 do I create 3x new nodes as search heads, then create the search head cluster and a separate deployer node - if so, how best do i point these to use the index cluster peers? I'm going to running this up in a lab, so I will update progress but if anyone has any initial guidance/pointers, that would be very much appreciated. Thx Bry ... View more

env: IDX multi-site cluster (1 master, 3 peers) 2x HF's 2x SH's I am wanting to move the defaultdb/main index to a bigger disk and I am hoping I can do this via an entry in indexes.conf and pushing via a bundle to the peers. Is it as straight forward as adding the following to /opt/splunk/etc/master-apps/_cluster/local/indexes.conf (as I do for other indexes I have created) [main] repFactor=auto homePath=/path/to/new/location/db coldPath=/path/to/new/location/colddb thawedPath=/path/to/new/location/thaweddb Then run 'splunk apply cluster-bundle' Do i have to do anything or will this in effect move the defaultdb/main index to the new path I have already created? Thx Bry ... View more