You should not have to interrupt the splunk or OS core services at all to upgrade, but it depends on your distribution. It could be as simple as
yum upgrade wait, test, move to the next server, and so on.
how about reboot after that.
yum upgrade requires a reboot for sure in order to take effect of full updates.
Can we reboot multiple Splunk indexers at least at once or should it only be individual ?