Deployment Architecture

How can I resolve this error I get from adding a new search head to my indexer clustering environment?

daniel_splunk
Splunk Employee
Splunk Employee

After I added a new search head to my indexer cluster environment, I started getting "Error = 'Couldn't deserialize, err=Deserialization failed parsing unsigned long long"

The searchhead is unable to update the peer information. Error = 'Couldn't deserialize, err=Deserialization failed parsing unsigned long long. key=num_buckets not found in json={"cluster_label":"00000000-0000-0000-0000-000000000001","eai:acl":null,"generation_id":839,"generation_peers":
0 Karma
1 Solution

daniel_splunk
Splunk Employee
Splunk Employee

You are getting that error because Splunk has strict versioning requirements within indexer clustering.

The cluster Master Node version must be greater than or equal to the Search Head.
The Search Head version must be greater than or equal to Search Peers.
ie. CM version => SH version => peers version

View solution in original post

daniel_splunk
Splunk Employee
Splunk Employee

You are getting that error because Splunk has strict versioning requirements within indexer clustering.

The cluster Master Node version must be greater than or equal to the Search Head.
The Search Head version must be greater than or equal to Search Peers.
ie. CM version => SH version => peers version

Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...