Installation

Splunk 4.3 upgrade question - disable?

gnovak
Builder

In the instructions here:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Upgradeyourdistributedenvironment

In the area where you are upgrading a distributed environment with multiple indexers and non-pooled search heads, it states that in step #4 you should:

  1. Disable and upgrade one of the search heads. Do not allow it to restart.

What exactly do they mean by "disable"? Stop splunk?

The search head we are updating is our main search head. It's the main console everyone logs into to use splunk. It searches 3 other main indexers. It also indexes data itself. I'm assuming they mean to stop splunk?

Can anyone clarify what "disable" means?

If these instructions are for non-pooled search heads, I can't see how disable would mean disabling it from being searched on by the rest of the pool if it's a non-pooled search head.

Tags (1)
1 Solution

jgedeon120
Contributor

$SPLUNK_HOME/bin/splunk disable boot-start
$SPLUNK_HOME/bin/splunk stop

Then do your upgrade(s).

$SPLUNK_HOME/bin/splunk enable boot-start
$SPLUNK_HOME/bin/splunk start

View solution in original post

jgedeon120
Contributor

$SPLUNK_HOME/bin/splunk disable boot-start
$SPLUNK_HOME/bin/splunk stop

Then do your upgrade(s).

$SPLUNK_HOME/bin/splunk enable boot-start
$SPLUNK_HOME/bin/splunk start

jgedeon120
Contributor

You're welcome.

0 Karma

gnovak
Builder

Thank you very much

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...