We have a Linux patch which requires a server reboot scheduled tonight for one out of the ten indexers. The patch would be applied at night at some point.
We wonder whether we should put the entire cluster on maintenance mode or maybe take this specific indexer off-line for the whole night.
Just found a good discussion at Is it better to use 'offline' mode or 'maintenance mode' in a multisite indexer cluster when a peer ...
Our sales engineer said -
No, offline that server nicely and add it back at your leisure.
Well as the docs say,
Maintenance mode halts most bucket fixup activity and prevents frequent rolling of hot buckets.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Indexer/Usemaintenancemode
What will happen when you put that peer offline is that all the hot buckets will be rolled to warm as a result of the splunk stop command.
If you do this very often, you may end up having very small buckets in your environment, which is not great as Splunk would need to check several buckets for the data someone has searched instead of few.