First It says "When you upgrade a 6.x indexer cluster, such as 6.2, to a later 6.x cluster, such as 6.3 or 6.4, you must take all cluster nodes offline. You cannot perform a rolling, online upgrade."
And later it says "Perform the following steps:
1. Stop the master.
2. Stop all the peers and search heads.
When bringing down the peers, use the splunk stop command, not splunk offline."
So first it says you need to take all cluster nodes (Peer nodes) offline, and then second it says do not splunk offline command. It is confusing, so please help me. Should I use the splunk offline command or splunk stop command for peer nodes and search head nodes in a search head cluster?
The docs are regrettably inconsistent in their use of the term "offline". The phrase, "... you must take all cluster nodes offline" means that you must take down the nodes. As the later note states, you must perform that action via the splunk stop command.