Deployment Architecture
Highlighted

Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster?

Explorer

Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster? I'm building a new search head cluster for my existing indexer cluster which is running 6.3.3. I would prefer to deploy a 6.4.0 search head cluster. Is mixing the two tiers supported?

Highlighted

Re: Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster?

Splunk Employee
Splunk Employee

If you are asking, "Can I run a 6.4.0 search head cluster against 6.3.3 peer nodes in an indexer cluster?", the answer is yes. See:

http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Systemrequirements#Compatibility_between_p...

A search head cluster running against indexer cluster peer nodes is itself considered part of the indexer cluster.

Highlighted

Re: Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster?

Explorer

Thanks Steve G., Please also confirm that if I build a v6.4 search head cluster, than I must also upgrade the cluster master to v6.4 as well. As the documentation appears to state this as a requirement.

"...the master node must run at the same or a higher level than both search heads and peer nodes. So, for example, you can have a 6.3 master node with a 6.3 search head and a set of 6.2 peer nodes. You cannot, however, have a 6.2 master node with a 6.3 search head and a set of 6.2 peer nodes. "

0 Karma
Highlighted

Re: Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster?

Explorer

Still looking for clarity on this question. If the search head cluster is considered part of the index cluster, then must I also plan on upgrading the master node to 6.4? This sentence seems to indicate this, but it was not mentioned in the above answer.

"...the master node must run at the same or a higher level than both search heads and peer nodes. So, for example, you can have a 6.3 master node with a 6.3 search head and a set of 6.2 peer nodes. You cannot, however, have a 6.2 master node with a 6.3 search head and a set of 6.2 peer nodes. "

0 Karma
Highlighted

Re: Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster?

Splunk Employee
Splunk Employee

Yes, the cluster master must be at the same or a higher level than both the search heads and the peer nodes.

So, if you are upgrading your search head cluster to 6.4, you must also upgrade the cluster master to 6.4. The peer nodes can remain at 6.3.3.

0 Karma
Highlighted

Re: Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster?

Path Finder

Yes, you can work with a 6.4 SH cluster and 6.3.x indexer cluster by upgrading the cluster master to 6.4.

Cluster Master should be on the latest or same version as your search heads.

*Splunk Version Compatibility sequence:*

Cluster Master >=Searchheads >=Indexers >=Heavy Forwarders>=Universal Forwarders