Some of this does not make sense. Are you planning an in-place upgrade, or an upgrade as part of a migration to another machine? An upgrade in conjunction with a migration is a more complex operation, and if you have enterprise support I would recommend opening a case to discuss the steps and get their recommendations for the smoothest upgrade experience.
If you stop splunkd on your indexer, then ALL buckets - hot, warm, or cold - will be quiesed and closed. There will be no active updates to any of them, and you can take a full offline backup.
While Splunkd is down, forwarders will not be able to communicate with the indexer. Depending on how you have your forwarders configured and the types of inputs you are processing, some data will be queued. How much and for how long is a function of your configuration. Once you exceed what can be queued, it is possible for some to be lost. Larger queues, persistent queues, or indexer acknowledgement will affect how much data can be held at the forwarder and for how long.
