I am planning to move Splunk indexers to a different location. These indexers are also part of the multi-site indexer cluster.
What would be the best way to proceed? Should I stop replication between the sites and then put indexers to be moved into a maintenance mode?
I would remove the site completely and become single site, migrate the machines, bring them back up, then go back to multi-site.