Deployment Architecture

Using different Splunk Version for Search Head Cluster as for the Indexer Cluster

salem34
Path Finder

Hi ninjas
I wonder wheter if it is supported having different splunk versions of the indexer cluster and the search head cluster.

Lets say we have an existing multiside indexer cluster and search head cluster running ond version 6.3x and i want to add an additonal search head cluster to that indexer cluster - can i go with the actual version of splunk for the new shc or should i use the same version as the existing ones?

Any one made experiences in that case? I didtnt found anything useful in the docs hop someone can help me out here.

Thanks in advance

0 Karma
1 Solution

Steve_G_
Splunk Employee
Splunk Employee

Compatibility requirements for nodes in an indexer cluster are listed here:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Systemrequirements#Splunk_Enterprise_versi...

It contains a subsection that addresses search head and peer node compatibility:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Systemrequirements#Compatibility_between_p...

It states: "Starting with 6.3, the peer nodes and search heads can run different versions from each other. The search heads must run the same or a later version from the peer nodes."

The end of that section also addresses the combined topology of indexer cluster and search head cluster: "Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads."

If you fulfill the requirement that the search heads in each search head cluster run the same or a later version of Splunk from the peer nodes, there doesn't seem to be any additional requirement that the two search head clusters must be running the same version.

Within each search head cluster, however, all search heads must be running the same version. See:

http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/SHCsystemrequirements#Splunk_Enterprise...

View solution in original post

Steve_G_
Splunk Employee
Splunk Employee

Compatibility requirements for nodes in an indexer cluster are listed here:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Systemrequirements#Splunk_Enterprise_versi...

It contains a subsection that addresses search head and peer node compatibility:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Systemrequirements#Compatibility_between_p...

It states: "Starting with 6.3, the peer nodes and search heads can run different versions from each other. The search heads must run the same or a later version from the peer nodes."

The end of that section also addresses the combined topology of indexer cluster and search head cluster: "Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads."

If you fulfill the requirement that the search heads in each search head cluster run the same or a later version of Splunk from the peer nodes, there doesn't seem to be any additional requirement that the two search head clusters must be running the same version.

Within each search head cluster, however, all search heads must be running the same version. See:

http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/SHCsystemrequirements#Splunk_Enterprise...

salem34
Path Finder

Thanks Steve!

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi salem34,

It is recommened that you bring your Splunk components to the same major version, since this is the kind of configurations and use scenarios that have been fully tested before GA release. Besides, version 6.5 introduces improvements to both the indexer and search head tiers:
- Indexer cluster data rebalancing
- Indexer clustering improvements Search
- Head clustering (SHC) improvements

Hope this helps. Thanks!
Hunter

salem34
Path Finder

Hi Hunter
Thanks for the response - yeah im aware of all the changes and improvements in 6.5 - the thing is though that upgrading the exisitng 6.3 environment will be done in the near future - but adding an additonal sh cluster will be done asap so im just wondering if we should already use the newest version of splunk for that new shc even the existing shc and idxc are running still an old version. That would also be a way to compare the two shc versions.
What gives me headache are any hiddne compatibility issues between 6.5 and 6.3 as there where a lot of changes (as you also mentioned) in 6.5 when it comes to clustering.

Cheers

0 Karma

jplumsdaine22
Influencer

I can't say whether or not it is supported, but we have run search heads and indexers with different minor versions without any trouble.

That said, it is advisable to run them all on the same version

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...