Deployment Architecture

What is the compatibility of versions when using distributed search?

Simeon
Splunk Employee
Splunk Employee

I have multiple indexers on various versions of Splunk and want to know if I can intermix the versions. Is there a compatibility matrix for distributed searching?

1 Solution

Simeon
Splunk Employee
Splunk Employee

Distributed searching between Splunk instances on different major releases is not supported. For example, the following combinations will not work:

  • Splunk 3.4 >> Splunk 4.1
  • Splunk 3.4 >> Splunk 4.0
  • Splunk 4.0 >> Splunk 4.1
  • Splunk 4.0 >> Splunk 3.4

However, you can perform basic search functionality from a Splunk 4.1.x search head to a Splunk 4.0.x search peer. Real-time searches will not work in this configuration. Additionally, this is not a recommended or supported architecture.

View solution in original post

Simeon
Splunk Employee
Splunk Employee

Distributed searching between Splunk instances on different major releases is not supported. For example, the following combinations will not work:

  • Splunk 3.4 >> Splunk 4.1
  • Splunk 3.4 >> Splunk 4.0
  • Splunk 4.0 >> Splunk 4.1
  • Splunk 4.0 >> Splunk 3.4

However, you can perform basic search functionality from a Splunk 4.1.x search head to a Splunk 4.0.x search peer. Real-time searches will not work in this configuration. Additionally, this is not a recommended or supported architecture.

Simeon
Splunk Employee
Splunk Employee

Splunk 4.3 >> 4.2 with limited functionality

Simeon
Splunk Employee
Splunk Employee

I believe 4.1.x and 4.2.x can search peer between eachother, with limited functionality.

Splunk 4.1 >> 4.2

Splunk 4.2 >> 4.1

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...