How to stop an Indexer Cluster rolling restart in Splunk Enterprise

Applicability

Description

There are instances when it may be necessary to stop an Indexer Cluster rolling restart, such as if it was accidentally initiated or triggered by the Cluster Manager at an inconvenient time.

Investigation

Navigate to the Indexer Clustering page of the Cluster Manager, where you'll see that the cluster is undergoing a rolling restart. If the process is stuck, it is likely due to a member being in a non-running state. Even if the rolling restart is in progress, it might be hung while attempting to restart the unhealthy peer.

Resolution

For 9.2.x and later versions, there is a CLI command to stop the rolling restart as described in the following documentation:

Abort a rolling restart using the CLI

Before the previous was introduced, a process to stop a rolling restart was not documented, however, the following could be attempted:

Access the Cluster Manager CLI

run the following command: $SPLUNK_HOME/bin/splunk restart

Please ensure there are available backups in case anything goes wrong

Related Links

Abort a rolling restart using the CLI

Rolling restart hung on "Reassigning primaries"- H... - Splunk Community