Simply resolved by restarting the Splunk instance running on the cluster master 🤣 ... View more

Thanks @isoutamo! I came to the same conclusion that it really depends on how many connections a HF has to deal with during the shutdown procedure.  What I am worried about is that when a deployment is due and all HFs need to restart, the long shutdown procedure makes the HFs farm not available for UFs to send the data (for as long as 4-5 minutes). Ideally, I would like to restart he HFs as quickly as possible.  Never heard about the detention mode. I will search for the term in Splunk docs.  ... View more