Search head 6.3 not compatible with cluster 6.2?

[rozmar564]

We have a cluster (master node + search indexers) and a few standalone search heads both running on 6.2.1. The other day I upgraded one of the search heads to 6.3. After upgrade the search head was not able to connect to the cluster anymore.

Is this expected (search head on 6.3 won't work with cluster on 6.2)?
To upgrade everything to 6.3 what is the correct order / procedure (would like to have minimal down time) ?

Thx for the pointers.

[maciep · Accepted solution]

I think that is expected. This is an excerpt from the doc linked below (see the second item):

For master nodes running Splunk Enterprise version 6.2 and above
Peer nodes and search heads can run different versions from the master, subject to these restrictions:

 The peer nodes and search heads must run version 6.1 or above.
 The peer nodes and search heads must run the same or a lower version than the master node.
 The peer nodes and search heads within a site must all run the same version.

http://docs.splunk.com/Documentation/Splunk/6.3.0/Indexer/Systemrequirements#Splunk_Enterprise_versi...

The upgrade documentation is out there as well. I think it says you need to take the entire cluster down to do the upgrade, but that's a bit insane. There is another recent question out here somewhere about a similar downtime concern.

[mikelanghorst]

Makes it difficult when you have a larger or more complex install. Trying to resync multiple nodes across a wan at the same time makes your network admins cry.

[rozmar564]

I did upgrades before - from 5.x to 6.x and from 6.x to 6.2 - its not that bad, but our business goes nuts even for 5 minutes of "outage", but I guess they just have to cope for a half hour or so.

[rozmar564]

Great - this answers my question - thank you!