I think I will test upgrade first on standalone instance and I will get my answers. Thanks  ... View more

Hi @richgalloway , Thank you so much for response really helpful for me. One more help needed could you please elaborate below point no.3 which I found from How to upgrade a distributed Splunk Enterprise environment - Splunk Documentation in Upgrade the search heads section Thanks       ... View more

Hi @att35, use btool command mentioned by @isoutamo  . It will give you much more idea.    Thanks Sam  ... View more

Hi @att35 , check props.conf on your UF or try using btool command. Please let  me know if it helps or you found solution already. Thanks Sam ... View more

Hi @gcusello , Apologies for the noob questions, I got below finding from Splunk docs. So editing indexes.conf on master node is fine as you mentioned before. but remove index's directories from each peer nodes.  we have 3 replication factor for each bucket.  so in that case I need to login all three peers and delete directories? we have around 6 peers, any way to find that out of 6 peers which three peers hold directories for xyz index. Or only way is I have to login on each peer and dig in directories to find out.     https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/RemovedatafromSplunk   Thanks  Sam ... View more

Hi @gcusello , Thanks for clearing out my confusion. Still I am not clear about few things, but I will look first what you suggested. Regards, Sam ... View more