Deployment Architecture

Search Head X running splunk version '6.4.0' does not support distributing searches to the following peers: {peer:Y version:6.4.3}

splunk_zen
Builder

What are the reasons which can cause this error in non clustered indexes ?

As both the major and minor versions are the same between the SH and indexer (only the maintenance one is lower on the SH), according to the compatibility matrix it should work

May this be due to a bundle replication issue?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Compatibility matters only at the level of major/minor release level, not at the maintenance level. For example, a 6.3 search head is not compatible with a 6.4 search peer, because the 6.3 search head is at a lower minor release level than the 6.4 search peer. However, a 6.3.1 search head is compatible with a 6.3.3 search peer, despite the lower maintenance release level of the search head.

http://docs.splunk.com/Documentation/Splunk/6.4.3/DistSearch/Distsearchsystemrequirements

May this be due to a bundle replication issue. or Synchronize system clocks -
It is important that you synchronize the system clocks on all machines, virtual or physical, that are running Splunk Enterprise instances participating in distributed search. Specifically, this means your search heads and search peers. In the case of search head pooling or mounted bundles, this also includes the shared storage hardware.
Otherwise, various issues can arise, such as bundle replication failures, search failures, or premature expiration of search artifacts.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

splunk_zen
Builder

We are indeed having bundle rep failures
Are you confirming that is the root cause for this error or just advancing that as a possibility ?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Splunk version is not the problem here.
as you say, bundle rep failures may be a possibility.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...