Deployment Architecture

Can I intermix indexer versions when using distributed search?

Splunk Employee
Splunk Employee

I have an installation of Splunk that consists of multiple indexers being searched by a distributed search head. Currently, these are all running 4.0.x and I want to upgrade to 4.1.x for some of the features. Can I run a 4.1.x search head with 4.0.x indexers?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

Splunk 4.1.x is capable of distributing searches to 4.0.x indexers. While this is not recommended or supported, you can get some of the 4.1.x features by running the search head on that version. 3.x indexers will not return results to any 4.x search head. Additionally, you cannot search a 4.1.x indexer from a 4.0.x search head.

Functional matrix:

  • 4.1.x ->> 4.0.x
  • 4.0.x ->> 4.0.x(-1)

View solution in original post

Explorer

I just tried that. My indexers are in 4.0 but my search head is in 4.1. Most of the queries and features work, except one so far. I believe the "join" command failed and didn't return any data. Thus, I rolled my search head back to 4.0 until I upgrade all my indexers to 4.1.

0 Karma

Splunk Employee
Splunk Employee

Splunk 4.1.x is capable of distributing searches to 4.0.x indexers. While this is not recommended or supported, you can get some of the 4.1.x features by running the search head on that version. 3.x indexers will not return results to any 4.x search head. Additionally, you cannot search a 4.1.x indexer from a 4.0.x search head.

Functional matrix:

  • 4.1.x ->> 4.0.x
  • 4.0.x ->> 4.0.x(-1)

View solution in original post

Splunk Employee
Splunk Employee

i think you should make a matrix

0 Karma