Deployment Architecture

Can I intermix indexer versions when using distributed search?

Simeon
Splunk Employee
Splunk Employee

I have an installation of Splunk that consists of multiple indexers being searched by a distributed search head. Currently, these are all running 4.0.x and I want to upgrade to 4.1.x for some of the features. Can I run a 4.1.x search head with 4.0.x indexers?

Tags (1)
1 Solution

Simeon
Splunk Employee
Splunk Employee

Splunk 4.1.x is capable of distributing searches to 4.0.x indexers. While this is not recommended or supported, you can get some of the 4.1.x features by running the search head on that version. 3.x indexers will not return results to any 4.x search head. Additionally, you cannot search a 4.1.x indexer from a 4.0.x search head.

Functional matrix:

  • 4.1.x ->> 4.0.x
  • 4.0.x ->> 4.0.x(-1)

View solution in original post

jiuan
Explorer

I just tried that. My indexers are in 4.0 but my search head is in 4.1. Most of the queries and features work, except one so far. I believe the "join" command failed and didn't return any data. Thus, I rolled my search head back to 4.0 until I upgrade all my indexers to 4.1.

0 Karma

Simeon
Splunk Employee
Splunk Employee

Splunk 4.1.x is capable of distributing searches to 4.0.x indexers. While this is not recommended or supported, you can get some of the 4.1.x features by running the search head on that version. 3.x indexers will not return results to any 4.x search head. Additionally, you cannot search a 4.1.x indexer from a 4.0.x search head.

Functional matrix:

  • 4.1.x ->> 4.0.x
  • 4.0.x ->> 4.0.x(-1)

gkanapathy
Splunk Employee
Splunk Employee

i think you should make a matrix

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...