Deployment Architecture

Search Head X running splunk version '6.4.0' does not support distributing searches to the following peers: {peer:Y version:6.4.3}

splunk_zen
Builder

What are the reasons which can cause this error in non clustered indexes ?

As both the major and minor versions are the same between the SH and indexer (only the maintenance one is lower on the SH), according to the compatibility matrix it should work

May this be due to a bundle replication issue?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Compatibility matters only at the level of major/minor release level, not at the maintenance level. For example, a 6.3 search head is not compatible with a 6.4 search peer, because the 6.3 search head is at a lower minor release level than the 6.4 search peer. However, a 6.3.1 search head is compatible with a 6.3.3 search peer, despite the lower maintenance release level of the search head.

http://docs.splunk.com/Documentation/Splunk/6.4.3/DistSearch/Distsearchsystemrequirements

May this be due to a bundle replication issue. or Synchronize system clocks -
It is important that you synchronize the system clocks on all machines, virtual or physical, that are running Splunk Enterprise instances participating in distributed search. Specifically, this means your search heads and search peers. In the case of search head pooling or mounted bundles, this also includes the shared storage hardware.
Otherwise, various issues can arise, such as bundle replication failures, search failures, or premature expiration of search artifacts.

splunk_zen
Builder

We are indeed having bundle rep failures
Are you confirming that is the root cause for this error or just advancing that as a possibility ?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Splunk version is not the problem here.
as you say, bundle rep failures may be a possibility.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...