Deployment Architecture

Indexer cluster: same operating system, but with different versions?

mas
Path Finder

Hi all,

according to official documentation, all indexer cluster nodes (master node, peer nodes, and search heads) must run on the same operating system (official documentation). It's not clear to me if this mean the same operating system type (e.g. SLES) or the same operating system type in the same version (e.g. SLES v12.3).

We are going to "upgrade" the cluster master and some search heads to a newer operating system version, creating new machines that will substitute the existing ones. We would like to move from SLES v11.4 to SLES v15.1, but indexers are running on SLES v12.3.

Mixing SLES v.12.3 (on indexers) and SLES v.15.1 (on cluster master and search head) could cause issues? In any case, we would install the same Splunk version on all cluster nodes.

Labels (1)

AhmedAYounis
Engager

Hello Mas, 
Could you please Mention whether you faced any problems or if there were any issues after the upgrade?   

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as long you are using enough close versions that should work. This enables you to upgrade OS to the newer versions. But to avoid additional weird issues, I suggest that you could upgrade those to the same major, minor and patch levels as soon as possible.

r. Ismo

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...