Deployment Architecture

Any issues with environment where your 5.0 SH searches both 5.x and 4.x indexers?

the_wolverine
Champion

I'd like to set up a new 5.0.3 cluster but I'd like to ALSO point the SH to my old 4.3 indexers so that I do not have to migrate the data. Are there any known issues with this configuration?

0 Karma

hjferrara
New Member

Now I have not had a chance to validate these statements, but I asked Splunk support a set of questions regarding capability between 4.x and 5.x. I will paste all the responses. From what support said, as long as your search heads are running 5.0.3+ and your indexers are 4.3+ - it should work. Of course with the normal caveat of not recommended - I took this to mean don't run it like this for too long and only as part of a phased upgrade.

1) Can 4.2+ search heads talk to 5.x+ indexers?
not tested, therefore not supported.

2) Can 4.3+ search heads talk to 5.x+ indexers?
not tested, therefore not supported.

3) Likewise is there issues with 5.x+ search heads talking to 4.2+ or 4.3+ indexers?

There is a problem if the SH is on version 5.0.1, 5.0.1, 5.0.2. and is fixed since 5.0.3
So it works without known issue, but is not recommend.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...