Hello, I have an automated upgrade plan that does the following: Puts the cluster in maintenance mode splunk enable maintenance-mode Goes 1 by 1 on each of the 3 indexer peers and runs: splunk offline Extracts upgrade tar file to necessary location runs splunk start and accepts license and answers yes. repeats for the next peer Disables maintenance mode. I am trying to upgrade the peers without the end users seeing messages but unfortunately users see things like the following:   Unable to distribute to peer named X because peer has status=Down. Verify uri-scheme, connectivity to the search peer, that the search peer is up, and that an adequate level of system resources are available. ^ Even though the peer is Up according to the Cluster Master   Connection Refused for peer=X ^ Which seems like the search heads are sending queries or still have an established connection with the peer. I would expect the search head to know that a peer is down and not communicate with it till it indexes have been validates and deemed searchable.   Anyone have recommendation on making the indexer upgrade as seamless to the end user as possible? Things tried: adjusted the restart_timeout, quiet_period, and decomission_node_force_timeout on the cluster master Thanks, J ... View more

We are trying to identify how much of our data is impacted by the latest timestamp bug. I was wondering if there was a query that used regex to search _raw for events that have 2 digit years. This will greatly help us analyze the risk of doing a last minute production upgrade... ... View more