Splunk Enterprise

How do these commands affect an RF=1 situation and rolling upgrade

PickleRick
SplunkTrust
SplunkTrust

As I wrote few times already I have in my care a relatively strange environment - a quite big installation with RF=1. Yes, I know I don't have data resilence and high availability - the customers knew it and accepted at the start of the project.

But since we're approaching the upgrade and as I'm reading the upgrade instructions, some questions pop up.

The normal procedure includes rolling upgrade of cluster member nodes. The rolling upgrade starts with

splunk upgrade-init cluster-peers 

and ends with

splunk upgrade-finalize cluster-peers

(or proper calls to REST endpoints).

Question is - what does those two commands really do and how it affects the RF=1 situation? As I asked before - it's pointless to put my cluster in maintenance mode and there is no bucket rebalancing after offline/online because there is nothing to rebalance.

So do I have to bother with all this or can I simply take the indexers down one by one, upgrade and start them up again? Yes, I know I won't have full search capacity during the indexer's downtime - it's obvious that if the data is not there I can't search it and my searches would be incomplete. The customers knows it and we'll schedule a "partial downtime".

What do you think?

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

It actually doesn’t really matter if you use rolling-upgrade or regular upgrade (one by one OR all at once) since your RF is 1. You’ll have searches will get affected (which is acceptable) so you can do all at once approach as well so minimize the change window. https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Upgradeacluster#Upgrade_all_peer_nodes_in...

View solution in original post

somesoni2
Revered Legend

It actually doesn’t really matter if you use rolling-upgrade or regular upgrade (one by one OR all at once) since your RF is 1. You’ll have searches will get affected (which is acceptable) so you can do all at once approach as well so minimize the change window. https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Upgradeacluster#Upgrade_all_peer_nodes_in...

PickleRick
SplunkTrust
SplunkTrust

I can't do all at once due to the volume of input data. If I take one indexer down HF's will fall back to the remaining ones and I shouldn't lose any data during the process.

So if I understand correctly, I should just simply upgrade master first, then search-heads, then indexers one by one and that's it, right?

0 Karma

somesoni2
Revered Legend

That's correct. Just regular upgrade works (tested).

PickleRick
SplunkTrust
SplunkTrust

Thank you!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...