topic Splunk Search Head and Indexer compatibility- Can a 9.0.4 version Search Head talk to 8.2.4 indexer? in Installation

Splunk Search Head and Indexer compatibility- Can a 9.0.4 version Search Head talk to 8.2.4 indexer?

neeravmathur — Thu, 01 Jun 2023 14:08:00 GMT

Hi Guys,

We have a distributed environment with Search Heads/Indexers/Deployement server/License Master/Heavy Forwarder etc in our architecture. All servers are on Splunk version 8.2.4
We are thinking to update to 9.0.4- What is the best way of doing this?
I mean can we upgrade Search Head to 9.0.4 and upgrade other servers later?
In other words- Can a 9.0.4 version Search Head talk to 8.2.4 indexer? Could not find a document for SH-IDX compatibility.

Since we have multiple servers, we cannot upgrade all the servers all at once.

Any help would be appreciated.

Re: Splunk Search Head and Indexer compatibility

gcusello — Thu, 01 Jun 2023 13:11:28 GMT

Hi @neeravmathur,

as described in many pages of Splunk documentation and Community Answers, the path should be:

Search Head,
Indexers
the other Splunk Enterprise roles (Deployement server/License Master/Heavy Forwarder)
Universal Forwarders.

Ciao.

Giuseppe

Re: Splunk Search Head and Indexer compatibility

isoutamo — Thu, 01 Jun 2023 13:16:30 GMT

here is Splunk's own instructions how you should do upgrade on distributed environment https://lantern.splunk.com/Splunk_Platform/Product_Tips/Upgrades_and_Migration/Upgrading_the_Splunk_platform. There are already quite many solved answers in community, which you could found via google search.

r. Ismo

Re: Splunk Search Head and Indexer compatibility

neeravmathur — Thu, 01 Jun 2023 13:16:45 GMT

@gcusello ,

So can we upgrade SH now and then update Indexer (later)-more than a month later

Searches will run fine against 8.2.4 indexers just fine?

Thanks,

Neerav

Re: Splunk Search Head and Indexer compatibility

richgalloway — Thu, 01 Jun 2023 13:17:52 GMT

There is a proscribed upgrade order. Do manager nodes first followed by SHs, indexers, and forwarders. See https://docs.splunk.com/Documentation/Splunk/9.0.4/Installation/UpgradeyourdistributedSplunkEnterpriseenvironment

Yes, SHs can be upgraded first (that's the recommendation). Other servers can be upgraded later. I suggest the indexers be upgraded "sooner" rather than "later", but the forwarders can wait a long time.

Re: Splunk Search Head and Indexer compatibility

isoutamo — Thu, 01 Jun 2023 13:21:28 GMT

If you have indexer cluster you must update it before search heads. Here https://docs.splunk.com/images/d/d3/Splunk_upgrade_order_of_ops.pdf?_ga=2.64880751.1162868428.1685612786-767476478.1685612786&_gl=1*1cm0ued*_ga*NzY3NDc2NDc4LjE2ODU2MTI3ODY.*_ga_5EPM2P39FV*MTY4NTYyMzE2MC4yLjEuMTY4NTYyNTU2MC42MC4wLjA. is order which you should follow when update distributed environment.

It's not recommended that you keep your cluster master and indexers on different major level that long. Then common understanding is that those could/should be on different level only as short time as possible. Basically this mean time to update all nodes. Of course it depends how big and active environment you have.