topic Multiple indexer versions in Splunk Search

Multiple indexer versions

jmheaton — Mon, 22 Apr 2013 13:33:34 GMT

So we recently put in a few more indexers running 5.0 but our old indexers are running 4.3.1

When looking at the Search Job Inspector i see
DEBUG: [index01] Adjusting search for peers with version (4.3.1): new remote search = 'litsearch

Is this actually slowing down my search results by a large amount or is this something that can be ignored. I'm searching roughly 30 million events over the last 24 hours, usually returning about 3 million results after about 7 minutes.

My main question is:
Currently we are running 13 indexers, 5 search heads, 10k forwarders, 3 heavy forwarders

Are my search results returning rather slow because i am lacking the hardware?
Indexers and searchheads are running dual quad core xenon E5504's with 12 gig of ram each

Re: Multiple indexer versions

OL — Mon, 22 Apr 2013 13:49:06 GMT

I would probably suggest to upgrade to the latest 5.x for indexers and search heads that you can use the report acceleration for this search if this is supported for it (check documentation), you will see, it will be sooo fast 🙂

If not supported, try to see if you can optimise your search if this is also possible.

Regards,
Olivier

Re: Multiple indexer versions

bosburn_splunk — Mon, 22 Apr 2013 13:56:26 GMT

As Oliver said having multiple versions in your environment will impact search speeds. For example, if your search heads are 5.0.x and your indexers are 4.x, you will not be able to leverage all the benefits of running 5.0.x.

If you can, get all your indexers up to the same revision.