We have 8 Splunk indexers in our environment (2 sites).
One indexer server needs to be serviced: update the BIOS, RAID controller firmware and iLO firmware.
What's the best business practice in these kind of cases?
1. Do we need to enable maintenance mode by running "splunk enable maintenance-mode"?
2. Do we need to take the peer offline by running "splunk offline"?
3. Do we need to disable start of Splunk on reboot temporary by running `splunk disable boot-start` in case this service task requires numerous reboots during the maintenance?
4. Any other advice?
Thank you in advance
↧