Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster?

[speedbump49]

Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster? I'm building a new search head cluster for my existing indexer cluster which is running 6.3.3. I would prefer to deploy a 6.4.0 search head cluster. Is mixing the two tiers supported?

[rcreddy06]

Yes, you can work with a 6.4 SH cluster and 6.3.x indexer cluster by upgrading the cluster master to 6.4.

Cluster Master should be on the latest or same version as your search heads.

*Splunk Version Compatibility sequence:*

Cluster Master >=Searchheads >=Indexers >=Heavy Forwarders>=Universal Forwarders

[Steve_G_]

If you are asking, "Can I run a 6.4.0 search head cluster against 6.3.3 peer nodes in an indexer cluster?", the answer is yes. See:

http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Systemrequirements#Compatibility_between_p...

A search head cluster running against indexer cluster peer nodes is itself considered part of the indexer cluster.

[speedbump49]

Still looking for clarity on this question. If the search head cluster is considered part of the index cluster, then must I also plan on upgrading the master node to 6.4? This sentence seems to indicate this, but it was not mentioned in the above answer.

"...the master node must run at the same or a higher level than both search heads and peer nodes. So, for example, you can have a 6.3 master node with a 6.3 search head and a set of 6.2 peer nodes. You cannot, however, have a 6.2 master node with a 6.3 search head and a set of 6.2 peer nodes. "

[Steve_G_]

Yes, the cluster master must be at the same or a higher level than both the search heads and the peer nodes.

So, if you are upgrading your search head cluster to 6.4, you must also upgrade the cluster master to 6.4. The peer nodes can remain at 6.3.3.

[speedbump49]

Thanks Steve G., Please also confirm that if I build a v6.4 search head cluster, than I must also upgrade the cluster master to v6.4 as well. As the documentation appears to state this as a requirement.

"...the master node must run at the same or a higher level than both search heads and peer nodes. So, for example, you can have a 6.3 master node with a 6.3 search head and a set of 6.2 peer nodes. You cannot, however, have a 6.2 master node with a 6.3 search head and a set of 6.2 peer nodes. "