Splunk indexer cluster CPU upgrade

[joe06031990]

Hi,

we have a two site 6 indexer cluster 3 per site and we are upgrading the CPU and each site will be offline for 3 hours per site, do I need to do anything on Splunk or do I need to run ./Splunk offline on 3 indexers at a time before they are shut down?

Thanks

[SanjayReddy · Accepted solution]

Hi @joe06031990 

Usally what I usally follow is I will enable maintenance mode on cluster manager and 
once activity done on indexers and up and running, will disbale maintenance mode. then all bucket fixup activitys will complete.

some use maintenance mode and splunk offline together. 

[joe06031990]

Thanks, if I enable maintenance mode won’t that stop data coming in or will the indexers that are up still be receiving data?