https://docs.splunk.com/Documentation/Splunk/9.2.1/ReleaseNotes/Fixedissues
https://docs.splunk.com/Documentation/Splunk/9.1.4/ReleaseNotes/Fixedissues
One customer reported a very interesting issue with graceful splunk restart.
Event missing during a graceful restart/rolling restart(splunk stop gracefully finished). useACK=true is an option but that ideally must be applied if splunk stop timed-out. This has been an issue for so many years.
This is important where config changes are pushed frequently, thus triggering frequent indexer/HF/IF restart.
The issue is fixed by 9.1.4/9.2.1
TcpInputProcessor not able to drain splunktcpin queue during graceful shutdown
How to detect if it's applicable for your deployment?
Check splunkd.log for
WARN TcpInputProc - Could not process data received from network. Aborting due to shutdown
Also from metrics.log see
https://community.splunk.com/t5/Knowledge-Management/During-indexer-restart-indexer-cluster-rolling-...
