Deployment Architecture
Highlighted

Can I intermix indexer versions when using distributed search?

Splunk Employee
Splunk Employee

I have an installation of Splunk that consists of multiple indexers being searched by a distributed search head. Currently, these are all running 4.0.x and I want to upgrade to 4.1.x for some of the features. Can I run a 4.1.x search head with 4.0.x indexers?

Tags (1)
Highlighted

Re: Can I intermix indexer versions when using distributed search?

Splunk Employee
Splunk Employee

Splunk 4.1.x is capable of distributing searches to 4.0.x indexers. While this is not recommended or supported, you can get some of the 4.1.x features by running the search head on that version. 3.x indexers will not return results to any 4.x search head. Additionally, you cannot search a 4.1.x indexer from a 4.0.x search head.

Functional matrix:

  • 4.1.x ->> 4.0.x
  • 4.0.x ->> 4.0.x(-1)

View solution in original post

Highlighted

Re: Can I intermix indexer versions when using distributed search?

Splunk Employee
Splunk Employee

i think you should make a matrix

0 Karma
Highlighted

Re: Can I intermix indexer versions when using distributed search?

Explorer

I just tried that. My indexers are in 4.0 but my search head is in 4.1. Most of the queries and features work, except one so far. I believe the "join" command failed and didn't return any data. Thus, I rolled my search head back to 4.0 until I upgrade all my indexers to 4.1.

0 Karma