Getting Data In

Can 6.5.2 indexers co-exist with 7.1.2 indexers?

louieb3
Path Finder

I will be upgrading 4 indexers from 6.5.2 to 7.1.2. Will I need to stop all 4 indexers, upgrade them all, and then start them all again on the same version? Or can I stop indexer1, upgrade, start, and then do the same for the rest of the indexers? In other words, can 6.5.2 indexers co-exist with 7.1.2 indexers?

Thanks in advance.

0 Karma

Lazarix
Communicator

Follow This Guide on how to upgrade a cluster, with various options depending on your topology.
In future versions (but not applicable for this scenario), you will be able to perform Rolling Upgrades

0 Karma

renjith_nair
Legend

Is it a distributed or cluster environment?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

louieb3
Path Finder

It's distributed.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You should be fine in a distributed environment.

---
If this reply helps you, Karma would be appreciated.

renjith_nair
Legend

As per http://docs.splunk.com/Documentation/Splunk/7.1.2/Installation/UpgradeyourdistributedSplunkEnterpris..., you could follow this approach

(Optional if you do not have downtime concerns) Choose an indexer to keep the environment running, and designate it as "Indexer #1".
(Optional if you do not have downtime concerns) Choose a second indexer to upgrade, and designate it as "Indexer #2."
If you need to maintain uptime, bring down all of the indexers except Indexer #1. Otherwise, bring all indexers down and continue at Step 7.
Upgrade Indexer #2.
Bring up Indexer #2 and test for operation and functionality.
Once you have confirmed proper operation on Indexer #2, bring down Indexer #1.
Upgrade Indexer #1 and all of the remaining indexers, one by one. You can restart the indexers immediately after you upgrade them.
Confirm operation and functionality across all of the indexers.
Restart the deployment server, and confirm its operation and functionality.

You might also need to check the forwarder - indexer compatibility ,especially between 6 & 7

http://docs.splunk.com/Documentation/Forwarder/7.1.2/Forwarder/Compatibilitybetweenforwardersandinde...

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...