Splunk Cloud

Splunk Cloud User Manual

Download manual as PDF

Download topic as PDF

Manage a rolling restart in Splunk Cloud

Some configuration updates can cause the indexers in your Splunk Cloud deployment to begin a process called a rolling restart. To minimize the impact of a rolling restart, deploy these updates during off-peak hours.

What users experience during a rolling restart

A rolling restart means that indexers restart in sequence.

Depending on the details of your data inputs, indexing probably continues. Using forwarders or other types of load balancers, rather than network inputs alone, increases the robustness of your indexing during a rolling restart.

Searches still run during a rolling restart, but they might return incomplete results. Users running searches in Splunk Web receive a message warning of incomplete search results.

What triggers a rolling restart

Deploying certain configuration changes triggers a rolling restart. Examples of changes that trigger a rolling restart include, but are not limited to, the following tasks:

  • Source type management
  • Deleting an index
  • Configuring HTTP Event Collector
  • Installing some apps and add-ons

Adding an index, for example, does not trigger a restart by itself. But if you or another admin has made other configuration changes and not deployed them, then when you deploy your change that adds an index, you also deploy the previous changes. In this way, deploying a seemingly safe change can indirectly trigger a rolling restart.

Guidance for managing a rolling restart

To minimize impact to users, deploy configuration changes during times that are off peak for both indexing and searching. You can identify off-peak times from the Snapshots in your Splunk Cloud Monitoring Console. See Monitor Splunk Cloud deployment health.

During a rolling restart, monitor indexing and search performance with the Splunk Cloud Monitoring Console.

More information

For more information about how a rolling restart works, see Use rolling restart in the Splunk Enterprise documentation. Note that some of the advanced options are not available by default in Splunk Cloud.

Manage private apps in your Splunk Cloud deployment
Upgrade your Forwarders

This documentation applies to the following versions of Splunk Cloud: 6.6.3, 7.0.0, 7.0.2, 7.0.3, 7.0.5, 7.0.8, 7.0.11, 7.1.3, 7.1.6, 7.2.3, 7.2.4, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 8.0.0

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters