In the instructions here:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Upgradeyourdistributedenvironment
In the area where you are upgrading a distributed environment with multiple indexers and non-pooled search heads, it states that in step #4 you should:
What exactly do they mean by "disable"? Stop splunk?
The search head we are updating is our main search head. It's the main console everyone logs into to use splunk. It searches 3 other main indexers. It also indexes data itself. I'm assuming they mean to stop splunk?
Can anyone clarify what "disable" means?
If these instructions are for non-pooled search heads, I can't see how disable would mean disabling it from being searched on by the rest of the pool if it's a non-pooled search head.
$SPLUNK_HOME/bin/splunk disable boot-start
$SPLUNK_HOME/bin/splunk stop
Then do your upgrade(s).
$SPLUNK_HOME/bin/splunk enable boot-start
$SPLUNK_HOME/bin/splunk start
$SPLUNK_HOME/bin/splunk disable boot-start
$SPLUNK_HOME/bin/splunk stop
Then do your upgrade(s).
$SPLUNK_HOME/bin/splunk enable boot-start
$SPLUNK_HOME/bin/splunk start
You're welcome.
Thank you very much