4.3.3 Search Heads with 4.2.1 Indexers?

[jbarteet]

Greetings,

I have a distributed environment with 13 indexers and a pair of search heads with pooled searches enabled, all running Splunk v4.2.1

I'm sizing up the task of upgrading this infrastructure to 4.3.3, and It looks like the way to go about this is to remove the search heads from the pool, update them, and then have the search heads rejoin the pool. THEN, after your search heads are all copacetic, you go and upgrade your indexers one at a time.

I'm looking at breaking up the upgrade project over at least two outages.

Here's my question: Can the 4.3.3 search heads run with the 4.2.1 indexers without any issues?

In the Distributed Deployment Manual for 4.3.3, it alludes to this with a footnote reading:

"Note: Search heads running the latest version of Splunk can communicate with indexers running earlier versions of Splunk"

There's no adverse affect of running 4.3.3 search heads on 4.2.1 indexers at all ?

I'm wondering if I can go a week or so between the tasks of upgrading the Search Heads and the Indxers.

Thank you, Splunk Brethren!

[joshd · Accepted solution]

I ran a 4.3.x search head against a 4.2.x indexer for a while without any issues... of course you will not be able to take advantage of any of the 4.3.x features until you upgrade your indexers 🙂