I'd like to set up a new 5.0.3 cluster but I'd like to ALSO point the SH to my old 4.3 indexers so that I do not have to migrate the data. Are there any known issues with this configuration?
Now I have not had a chance to validate these statements, but I asked Splunk support a set of questions regarding capability between 4.x and 5.x. I will paste all the responses. From what support said, as long as your search heads are running 5.0.3+ and your indexers are 4.3+ - it should work. Of course with the normal caveat of not recommended - I took this to mean don't run it like this for too long and only as part of a phased upgrade.
1) Can 4.2+ search heads talk to 5.x+ indexers?
not tested, therefore not supported.
2) Can 4.3+ search heads talk to 5.x+ indexers?
not tested, therefore not supported.
3) Likewise is there issues with 5.x+ search heads talking to 4.2+ or 4.3+ indexers?
There is a problem if the SH is on version 5.0.1, 5.0.1, 5.0.2. and is fixed since 5.0.3
So it works without known issue, but is not recommend.