I have a small system with one indexing server receiving information from forwarders on six other servers. Should the system be stopped before upgrading?
... View more
run the search
index=_internal sourcetype=splunkd fail
The return will have information to narrow the search for the clients that have problems.
... View more