You may have encountered a case where you have to update the operating system version where Splunk resides, in this case Red Hat 7.x to 9.x, is there any consideration that should be taken into account, considering that there are two instances that fulfill the indexer role and there is another cluster instance that manages both, the latter will not be updated. I was thinking of cloning each server and updating it in an isolated network, then exchanging them one by one in the production environment, you will know if that works or I should apply another strategy
