I am planing a Splunk upgrade, master and search head cluster are on 7.0 but next step is to upgrade multisite Indexer cluster, since we are critical on downtime. All Indexers are at same 6.4.*
Can site1 indexer on 6.5 work with site2 Indexers on 6.4 ? Final goal is to bring them to 7.0.
We do support a site-by-site upgrade for multi-site clusters, but the recommendation is to bring both sites to the same version as quickly as possible.
This process and the constraints are documented here.