Deployment Architecture

Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster?

Explorer

Can I mix a Splunk 6.4.0 search head cluster with a Splunk 6.3.3 indexer cluster? I'm building a new search head cluster for my existing indexer cluster which is running 6.3.3. I would prefer to deploy a 6.4.0 search head cluster. Is mixing the two tiers supported?

Path Finder

Yes, you can work with a 6.4 SH cluster and 6.3.x indexer cluster by upgrading the cluster master to 6.4.

Cluster Master should be on the latest or same version as your search heads.

*Splunk Version Compatibility sequence:*

Cluster Master >=Searchheads >=Indexers >=Heavy Forwarders>=Universal Forwarders

Splunk Employee
Splunk Employee

If you are asking, "Can I run a 6.4.0 search head cluster against 6.3.3 peer nodes in an indexer cluster?", the answer is yes. See:

http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Systemrequirements#Compatibility_between_p...

A search head cluster running against indexer cluster peer nodes is itself considered part of the indexer cluster.

Explorer

Still looking for clarity on this question. If the search head cluster is considered part of the index cluster, then must I also plan on upgrading the master node to 6.4? This sentence seems to indicate this, but it was not mentioned in the above answer.

"...the master node must run at the same or a higher level than both search heads and peer nodes. So, for example, you can have a 6.3 master node with a 6.3 search head and a set of 6.2 peer nodes. You cannot, however, have a 6.2 master node with a 6.3 search head and a set of 6.2 peer nodes. "

0 Karma

Splunk Employee
Splunk Employee

Yes, the cluster master must be at the same or a higher level than both the search heads and the peer nodes.

So, if you are upgrading your search head cluster to 6.4, you must also upgrade the cluster master to 6.4. The peer nodes can remain at 6.3.3.

0 Karma

Explorer

Thanks Steve G., Please also confirm that if I build a v6.4 search head cluster, than I must also upgrade the cluster master to v6.4 as well. As the documentation appears to state this as a requirement.

"...the master node must run at the same or a higher level than both search heads and peer nodes. So, for example, you can have a 6.3 master node with a 6.3 search head and a set of 6.2 peer nodes. You cannot, however, have a 6.2 master node with a 6.3 search head and a set of 6.2 peer nodes. "

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!