Restarting the Event Consumers

If your ArcSight Platform deployment includes a capability that needs the ArcSight Database, such as Intelligence, complete the following procedure after upgrading the Platform.

  1. (Conditional) If you have Intelligence deployed, complete the following steps:

    1. Log in to the Transformation Hub node.
    2. Run the following commands:
      3. NS=$(kubectl get namespaces | awk '/arcsight/{print $1}')
      kubectl scale statefulset interset-logstash -n $NS  --replicas={replica count}
      where {replica count} represents one of the following values:
      • The number in the READY column that you captured in Step 6 of "Stopping the ESM and Intelligence Event Consumers."
      • A new replica count value that you defined for Intelligence during the recent upgrade