I wonder wheter if it is supported having different splunk versions of the indexer cluster and the search head cluster.
Lets say we have an existing multiside indexer cluster and search head cluster running ond version 6.3x and i want to add an additonal search head cluster to that indexer cluster - can i go with the actual version of splunk for the new shc or should i use the same version as the existing ones?
Any one made experiences in that case? I didtnt found anything useful in the docs hop someone can help me out here.
Thanks in advance
I can't say whether or not it is supported, but we have run search heads and indexers with different minor versions without any trouble.
That said, it is advisable to run them all on the same version
It is recommened that you bring your Splunk components to the same major version, since this is the kind of configurations and use scenarios that have been fully tested before GA release. Besides, version 6.5 introduces improvements to both the indexer and search head tiers:
- Indexer cluster data rebalancing
- Indexer clustering improvements Search
- Head clustering (SHC) improvements
Hope this helps. Thanks!
Thanks for the response - yeah im aware of all the changes and improvements in 6.5 - the thing is though that upgrading the exisitng 6.3 environment will be done in the near future - but adding an additonal sh cluster will be done asap so im just wondering if we should already use the newest version of splunk for that new shc even the existing shc and idxc are running still an old version. That would also be a way to compare the two shc versions.
What gives me headache are any hiddne compatibility issues between 6.5 and 6.3 as there where a lot of changes (as you also mentioned) in 6.5 when it comes to clustering.
Compatibility requirements for nodes in an indexer cluster are listed here:
It contains a subsection that addresses search head and peer node compatibility:
It states: "Starting with 6.3, the peer nodes and search heads can run different versions from each other. The search heads must run the same or a later version from the peer nodes."
The end of that section also addresses the combined topology of indexer cluster and search head cluster: "Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads."
If you fulfill the requirement that the search heads in each search head cluster run the same or a later version of Splunk from the peer nodes, there doesn't seem to be any additional requirement that the two search head clusters must be running the same version.
Within each search head cluster, however, all search heads must be running the same version. See: