We followed the following documentation: https://docs.splunk.com/Documentation/ES/8.0.40/Install/UpgradetoNewVersion There is mentioned, that you need to updated the "Splunk_TA_ForIndexer" app.   During our upgrade, the required indexes were deployed on one single searchhead in the cluster and we had to "move them" to our index cluster.  We did it by our internal procedures. I am not aware that there is a clear documentation what you have to do exactly if you have this issue too. ... View more

Thanks for the hint. Now I know where to search. Yes, the indexes were deployed but the wrong way (the indexes were created on the searchhead and not in the cluster...) In our environment, the app deployments does not get done by me and I have then to figure out what are the issues... ... View more