We need to upgrade the hardware on our Cluster Master. What is the best approach for downtime for this upgrade?

[mlevsh]

Our Splunk Cluster Master is under resourced. To match Splunk support's recommendations we need to add CPU and RAM to it. We have 8 indexers on an indexer cluster. This upgrade will require about 30 minutes of downtime of our cluster master server.
What's the best approach for a cluster master hardware upgrade?

[jkat54 · Accepted solution]

Put the cluster in maintenance mode, stop the cluster master, shut down the cluster master, perform the upgrade, restart the cluster master, restart splunk (note splunk may be set to auto start), exiting maintenance mode occurs automatically with restarts.

Maintenance mode does not persist across master restarts.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Usemaintenancemode

[mlevsh]

@jkat54 , thank you for a quick reply!

[jkat54]

You're welcome!