Deployment Architecture

Search Head X running splunk version '6.4.0' does not support distributing searches to the following peers: {peer:Y version:6.4.3}

splunk_zen
Builder

What are the reasons which can cause this error in non clustered indexes ?

As both the major and minor versions are the same between the SH and indexer (only the maintenance one is lower on the SH), according to the compatibility matrix it should work

May this be due to a bundle replication issue?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Compatibility matters only at the level of major/minor release level, not at the maintenance level. For example, a 6.3 search head is not compatible with a 6.4 search peer, because the 6.3 search head is at a lower minor release level than the 6.4 search peer. However, a 6.3.1 search head is compatible with a 6.3.3 search peer, despite the lower maintenance release level of the search head.

http://docs.splunk.com/Documentation/Splunk/6.4.3/DistSearch/Distsearchsystemrequirements

May this be due to a bundle replication issue. or Synchronize system clocks -
It is important that you synchronize the system clocks on all machines, virtual or physical, that are running Splunk Enterprise instances participating in distributed search. Specifically, this means your search heads and search peers. In the case of search head pooling or mounted bundles, this also includes the shared storage hardware.
Otherwise, various issues can arise, such as bundle replication failures, search failures, or premature expiration of search artifacts.

splunk_zen
Builder

We are indeed having bundle rep failures
Are you confirming that is the root cause for this error or just advancing that as a possibility ?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Splunk version is not the problem here.
as you say, bundle rep failures may be a possibility.

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...