Splunk Enterprise

How do these commands affect an RF=1 situation and rolling upgrade

PickleRick
SplunkTrust
SplunkTrust

As I wrote few times already I have in my care a relatively strange environment - a quite big installation with RF=1. Yes, I know I don't have data resilence and high availability - the customers knew it and accepted at the start of the project.

But since we're approaching the upgrade and as I'm reading the upgrade instructions, some questions pop up.

The normal procedure includes rolling upgrade of cluster member nodes. The rolling upgrade starts with

splunk upgrade-init cluster-peers 

and ends with

splunk upgrade-finalize cluster-peers

(or proper calls to REST endpoints).

Question is - what does those two commands really do and how it affects the RF=1 situation? As I asked before - it's pointless to put my cluster in maintenance mode and there is no bucket rebalancing after offline/online because there is nothing to rebalance.

So do I have to bother with all this or can I simply take the indexers down one by one, upgrade and start them up again? Yes, I know I won't have full search capacity during the indexer's downtime - it's obvious that if the data is not there I can't search it and my searches would be incomplete. The customers knows it and we'll schedule a "partial downtime".

What do you think?

Labels (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

It actually doesn’t really matter if you use rolling-upgrade or regular upgrade (one by one OR all at once) since your RF is 1. You’ll have searches will get affected (which is acceptable) so you can do all at once approach as well so minimize the change window. https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Upgradeacluster#Upgrade_all_peer_nodes_in...

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

It actually doesn’t really matter if you use rolling-upgrade or regular upgrade (one by one OR all at once) since your RF is 1. You’ll have searches will get affected (which is acceptable) so you can do all at once approach as well so minimize the change window. https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Upgradeacluster#Upgrade_all_peer_nodes_in...

PickleRick
SplunkTrust
SplunkTrust

I can't do all at once due to the volume of input data. If I take one indexer down HF's will fall back to the remaining ones and I shouldn't lose any data during the process.

So if I understand correctly, I should just simply upgrade master first, then search-heads, then indexers one by one and that's it, right?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

That's correct. Just regular upgrade works (tested).

PickleRick
SplunkTrust
SplunkTrust

Thank you!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...