Upgrading go not cause a loss of data, the only consequence is when you have to restart Splunk you may miss events send as UDP/TCP.
To accept data all the time, use those techniques :
- splunk forwarders (they can queue and pause monitoring, and use persistent queues)
- rsyslog/syslog-ng to write to file your syslog data (and act as buffer)
- multiple indexers in a load balanced cluster (so you can shut the down one at a time)
