After I added a new search head to my indexer cluster environment, I started getting "Error = 'Couldn't deserialize, err=Deserialization failed parsing unsigned long long"
The searchhead is unable to update the peer information. Error = 'Couldn't deserialize, err=Deserialization failed parsing unsigned long long. key=num_buckets not found in json={"cluster_label":"00000000-0000-0000-0000-000000000001","eai:acl":null,"generation_id":839,"generation_peers":
You are getting that error because Splunk has strict versioning requirements within indexer clustering.
The cluster Master Node version must be greater than or equal to the Search Head.
The Search Head version must be greater than or equal to Search Peers.
ie. CM version => SH version => peers version
You are getting that error because Splunk has strict versioning requirements within indexer clustering.
The cluster Master Node version must be greater than or equal to the Search Head.
The Search Head version must be greater than or equal to Search Peers.
ie. CM version => SH version => peers version