Hello everyone,
i'm actually dealing with an infrastructure composed by three search heads, two indexer and a single instance with master node, license master and deployer together.
Now, for maintainance activity, the master machine will be turned off for 48 hours.
I have few questions about the possible consequences and preliminary step:
It is sufficient to stop the splunk service on the istance?
Does indexing still continue?
If indexing stop, which other file to put inside a back up splunk machine in addition to server.conf and master-app, considering also deployer and license master capabilities?
If everything goes right, it is sufficient to start the splunk service on the master machine (primary)?
Thanks in advance.
... View more