Upgrade according to docs there are 2 options:
1. all at once
2. each tier at a time
read here:
http://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Upgradeacluster
my suggestion:
first all the management instances, e.g. License Master, DMC, Cluster Master, Deployment Server.
then upgrade the search tier, e.g . the Search Heads.
lastly, upgrade the Indexer tier, e.g. the Indexers.
stop all of them -> enable maintenance mode on Cluster Master (you already upgraded this dude) -> watch the Indexers come to life again -> disable maintenance mode -> wait for the next great Splunk release
good luck
... View more