Performing maintenance on search heads of a data intake and query system with minimal performance impact

A computing device, comprising:

• a processor;
• and
• a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:
• during a maintenance window for a deployment of a data intake and query system, determining a configuration of one or more search heads in the data intake and query system to be upgraded;
• responsive to a determination that the one or more search heads comprises a plurality of search heads arranged in a first cluster, performing a first rolling upgrade for the one or more search heads in the plurality of search heads;
• and
• responsive to a determination that the one or more search heads comprises a single search head:
• adding additional search heads to the configuration with the single search head to form a second cluster, and
• performing a second rolling upgrade for search heads in the second cluster, wherein performing the second rolling upgrade includes:
• allowing a short-running search within a timeout period to finish executing;
• and
• aborting a long-running search exceeding the timeout period, wherein the long-running search is re-initiated subsequent to the second rolling upgrade.

A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processor to perform operations including:

• during a maintenance window for a deployment of a data intake and query system, determining a configuration of one or more search heads in the data intake and query system to be upgraded;
• responsive to a determination that the one or more search heads comprises a plurality of search heads arranged in a first cluster, performing a rolling upgrade process for the one or more search heads in the plurality of search heads;
• and
• responsive to a determination that the one or more search heads comprises a single search head:
• adding additional search heads to the configuration with the single search head to form a second cluster, and
• performing a second rolling upgrade for search heads in the second cluster, wherein performing the second rolling upgrade includes:
• allowing a short-running search within a timeout period to finish executing;
• and
• aborting a long-running search exceeding the timeout period, wherein the long-running search is re-initiated subsequent to the second rolling upgrade.