Greetz,
Is it possible to stop/start or restart a search peer while it is handling a search request
from a search head and have the search still complete?
Is there any way to signal to the head to "hold on" or something?
Do I assume the distsearch continues over the available splunk_servers
but results will be incomplete from the restarted peer?
Thanks.
Correct, if a search peer goes offline you have a distinct possibility that your result set will be incomplete. If you only have a few indexers, you could monitor how many searches are running and restart when the system is quiet. Unfortunately if you have as many saved scheduled searches as I do, that is never. Hope this helps.