What is the difference between maintenance mode versus off-line during a Linux patch?

[ddrillic]

We have a Linux patch which requires a server reboot scheduled tonight for one out of the ten indexers. The patch would be applied at night at some point.

We wonder whether we should put the entire cluster on maintenance mode or maybe take this specific indexer off-line for the whole night.

[ddrillic]

Just found a good discussion at Is it better to use 'offline' mode or 'maintenance mode' in a multisite indexer cluster when a peer ...

[ddrillic]

Our sales engineer said -

• Well don't put the entire cluster in maintenance mode, that would cause an enormous amount of load when you brought it out of maintenance mode, and makes your new data since the maintenance mode went into effect very unsafe.

No, offline that server nicely and add it back at your leisure.

[tiagofbmm]

Well as the docs say,

Maintenance mode halts most bucket fixup activity and prevents frequent rolling of hot buckets.

https://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Usemaintenancemode

What will happen when you put that peer offline is that all the hot buckets will be rolled to warm as a result of the splunk stop command.

If you do this very often, you may end up having very small buckets in your environment, which is not great as Splunk would need to check several buckets for the data someone has searched instead of few.