Deployment Architecture

Search Head X running splunk version '6.4.0' does not support distributing searches to the following peers: {peer:Y version:6.4.3}

splunk_zen
Builder

What are the reasons which can cause this error in non clustered indexes ?

As both the major and minor versions are the same between the SH and indexer (only the maintenance one is lower on the SH), according to the compatibility matrix it should work

May this be due to a bundle replication issue?

0 Karma

inventsekar
Super Champion

Compatibility matters only at the level of major/minor release level, not at the maintenance level. For example, a 6.3 search head is not compatible with a 6.4 search peer, because the 6.3 search head is at a lower minor release level than the 6.4 search peer. However, a 6.3.1 search head is compatible with a 6.3.3 search peer, despite the lower maintenance release level of the search head.

http://docs.splunk.com/Documentation/Splunk/6.4.3/DistSearch/Distsearchsystemrequirements

May this be due to a bundle replication issue. or Synchronize system clocks -
It is important that you synchronize the system clocks on all machines, virtual or physical, that are running Splunk Enterprise instances participating in distributed search. Specifically, this means your search heads and search peers. In the case of search head pooling or mounted bundles, this also includes the shared storage hardware.
Otherwise, various issues can arise, such as bundle replication failures, search failures, or premature expiration of search artifacts.

splunk_zen
Builder

We are indeed having bundle rep failures
Are you confirming that is the root cause for this error or just advancing that as a possibility ?

0 Karma

inventsekar
Super Champion

Splunk version is not the problem here.
as you say, bundle rep failures may be a possibility.

0 Karma