Splunk App for AWS on Splunk Enterprise - indexer and search head Splunk version

[usup_rajbahak]

hello,

looks like this app requires Splunk Enterprise to be of at least v 6.5.0. Do the indexers also need to be of v6.5.0, or is it okay if just the search head that the app and the add will be installed on is running Splunk v6.5.0?

Thanks in advance.

Usup

[esix_splunk]

Depends on your architecture.

The AWS App, which goes on your SH, should be the recommended version in the DOCS. There is technically no portion that should go on your indexers, unless you are doing the data collection from there. But typically the TA goes on a HF or your SH, depending on where you do your data collection.

You can refer to this handy matrix : http://docs.splunk.com/Documentation/AddOns/released/AWS/Distributeddeployment

[usup_rajbahak]

Thanks esix..
we have a two indexers cluster with a handful of search heads all running 6.4.x version of Splunk.. we will not be installing the app/add on on the indexers. A HF that will be forwarding the logs to the clustered indexers..

We needed to understand whether the clustered indexers also needed to be of the same version as the the search head (and the HF) that will host the AWS app/add on.