Deployment Architecture

4.2 Search head with a 4.3 Search peer

johandk
Path Finder

We are looking to upgrade all our instances to 4.3 and will end up with 4.2 search heads distributing to 4.3 search peers.

Has anyone tested this? Are there any caveats we should be aware of?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

This will work and I believe is a supported configuration. However, you will of course be unable to use any new 4.3 search features (e.g., new search commands, per-result alerting, historical backfill in real-time searches), and of course the UI and workflow will be 4.2. About the only new 4.3 feature that you can use is Bloom filters.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

This will work and I believe is a supported configuration. However, you will of course be unable to use any new 4.3 search features (e.g., new search commands, per-result alerting, historical backfill in real-time searches), and of course the UI and workflow will be 4.2. About the only new 4.3 feature that you can use is Bloom filters.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...