Splunk Enterprise

How do these commands affect an RF=1 situation and rolling upgrade

PickleRick
Ultra Champion

As I wrote few times already I have in my care a relatively strange environment - a quite big installation with RF=1. Yes, I know I don't have data resilence and high availability - the customers knew it and accepted at the start of the project.

But since we're approaching the upgrade and as I'm reading the upgrade instructions, some questions pop up.

The normal procedure includes rolling upgrade of cluster member nodes. The rolling upgrade starts with

splunk upgrade-init cluster-peers 

and ends with

splunk upgrade-finalize cluster-peers

(or proper calls to REST endpoints).

Question is - what does those two commands really do and how it affects the RF=1 situation? As I asked before - it's pointless to put my cluster in maintenance mode and there is no bucket rebalancing after offline/online because there is nothing to rebalance.

So do I have to bother with all this or can I simply take the indexers down one by one, upgrade and start them up again? Yes, I know I won't have full search capacity during the indexer's downtime - it's obvious that if the data is not there I can't search it and my searches would be incomplete. The customers knows it and we'll schedule a "partial downtime".

What do you think?

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

It actually doesn’t really matter if you use rolling-upgrade or regular upgrade (one by one OR all at once) since your RF is 1. You’ll have searches will get affected (which is acceptable) so you can do all at once approach as well so minimize the change window. https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Upgradeacluster#Upgrade_all_peer_nodes_in...

View solution in original post

somesoni2
Revered Legend

It actually doesn’t really matter if you use rolling-upgrade or regular upgrade (one by one OR all at once) since your RF is 1. You’ll have searches will get affected (which is acceptable) so you can do all at once approach as well so minimize the change window. https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Upgradeacluster#Upgrade_all_peer_nodes_in...

PickleRick
Ultra Champion

I can't do all at once due to the volume of input data. If I take one indexer down HF's will fall back to the remaining ones and I shouldn't lose any data during the process.

So if I understand correctly, I should just simply upgrade master first, then search-heads, then indexers one by one and that's it, right?

0 Karma

somesoni2
Revered Legend

That's correct. Just regular upgrade works (tested).

PickleRick
Ultra Champion

Thank you!

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...