Order in which Splunk servers should be patched & rebooted. Some has to be put in maintenacce mode right?

[SamHTexas]

I have a LM, CM , few Unix servers containing my Indexers. Would like to patch the unix servers & reboot them.

in what order in which Splunk servers (Unix servers) should be patched & rebooted. Some has to be put in maintenacce mode right?

[richgalloway · Accepted solution]

If you're just patching the OS then the sequence doesn't matter, but I would do LM, CM, then indexers.  Yes, the indexer cluster should be put into maintenance mode.