I have a small system with one indexing server receiving information from forwarders on six other servers. Should the system be stopped before upgrading?
Yes. You cannot upgrade Splunk without stopping it first.
