Deployment Architecture

Search Head X running splunk version '6.4.0' does not support distributing searches to the following peers: {peer:Y version:6.4.3}

splunk_zen
Builder

What are the reasons which can cause this error in non clustered indexes ?

As both the major and minor versions are the same between the SH and indexer (only the maintenance one is lower on the SH), according to the compatibility matrix it should work

May this be due to a bundle replication issue?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Compatibility matters only at the level of major/minor release level, not at the maintenance level. For example, a 6.3 search head is not compatible with a 6.4 search peer, because the 6.3 search head is at a lower minor release level than the 6.4 search peer. However, a 6.3.1 search head is compatible with a 6.3.3 search peer, despite the lower maintenance release level of the search head.

http://docs.splunk.com/Documentation/Splunk/6.4.3/DistSearch/Distsearchsystemrequirements

May this be due to a bundle replication issue. or Synchronize system clocks -
It is important that you synchronize the system clocks on all machines, virtual or physical, that are running Splunk Enterprise instances participating in distributed search. Specifically, this means your search heads and search peers. In the case of search head pooling or mounted bundles, this also includes the shared storage hardware.
Otherwise, various issues can arise, such as bundle replication failures, search failures, or premature expiration of search artifacts.

splunk_zen
Builder

We are indeed having bundle rep failures
Are you confirming that is the root cause for this error or just advancing that as a possibility ?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Splunk version is not the problem here.
as you say, bundle rep failures may be a possibility.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...