I would need to upgrade my cluster from 6.4 to 6.5.2 latest release. I have components listed below,
License Master (already upgraded to 6.5.2 and using no enforcement key)
Cluster Master ( running on 6.4)
Deployment Server (running on 6.4)
Two Search Heads ( running on 6.4 but not in search head cluster or search head pooling. one is for adhoc and another one is for Enterprise security)
Six Indexers ( running on 6.4 and are in cluster and sf=1 and rf=1)
I need to upgrade all Splunk infra to 6.5.2 ( latest release) .
I read two documents saying two different procedures :
first document says all Indexers should be stopped and upgraded at the same time:
Upgrade a 6.x indexer cluster to a later version of 6.x When you upgrade a 6.x indexer cluster, such as 6.2, to a later 6.x cluster, such as 6.3 or 6.4, you must take down all cluster nodes. You cannot perform a rolling, online upgrade. If you have a multisite cluster, however, you can upgrade one site at a time. See Site-by-site upgrade for multisite indexer clusters.
Perform the following steps:
Stop the master.
Stop all the peers and search heads.
When bringing down the peers, use the splunk stop command, not splunk offline.
Upgrade the master node, following the normal procedure for any Splunk Enterprise upgrade, as described in How to upgrade Splunk Enterprise in the Installation Manual. Do not upgrade the peers yet.
Start the master, accepting all prompts, if it is not already running.
Run splunk enable maintenance-mode on the master. To confirm that the master is in maintenance mode, run splunk show maintenance-mode. This step prevents unnecessary bucket fix-ups. See Use maintenance mode.
Upgrade the peer nodes and search heads, following the normal procedure for any Splunk Enterprise upgrade, as described in How to upgrade Splunk Enterprise in the Installation Manual.
If the search heads in the indexer cluster are members of a search head cluster, see Upgrade a search head cluster.
Start the peer nodes and search heads, if they are not already running.
Run splunk disable maintenance-mode on the master. To confirm that the master is not in maintenance mode, run splunk show maintenance-mode.
You can view the master dashboard to verify that all cluster nodes are up and running.
second document says :
Upgrade a distributed environment with multiple indexers and non-pooled search heads This procedure upgrades the search head tier, then the indexing tier, to maintain availability.
Prepare the upgrade Confirm that any apps that the non-pooled search heads use will work on the upgraded version of Splunk, as described in "Test your apps prior to the upgrade" in this topic. (Optional) If you use a deployment server in your environment, disable it temporarily. This prevents the server from distributing invalid configurations to your other components. (Optional) Upgrade the deployment server, but do not restart it. Upgrade the search heads Disable one of the search heads. Upgrade the search head. Do not let it restart. After you upgrade the search head, place the confirmed working apps into the $SPLUNK_HOME/etc/apps directory of the search head. Re-enable and restart the search head. Test apps on the search head for operation and functionality. If there are no problems with the search head, then disable and upgrade the remaining search heads, one by one. Repeat this step until you have reached the last search head in your environment. (Optional) Test each search head for operation and functionality after you bring it up. After you upgrade the last search head, test all of the search heads for operation and functionality. Upgrade the indexers Disable and upgrade the indexers, one by one. You can restart the indexers immediately after you upgrade them. Test search heads to ensure that they find data across all indexers. After you upgrade all indexers, restart your deployment server.
kindly let me which document should I need to follow to upgrade my full Splunk infra.
Thanks in advance.
... View more