Which splunk version to use to build the new Splunk Infrastructure environment?

[lksridhar]

Hi Folks,

we are planning to build the new Splunk infrastructure(distributed search environment) and we thought to use 7.0.0 Splunk version for all the comments(IDX, SH, UF) but not sure whether it is the best practice or not.

Could anyone confirm if can we use the same version for all the components?

[lksridhar]

Thanks renjith and cbastashutterfly for your information.

[cbastashutterfl]

Are you asking if you should go to 7.0.0 vs the latest? If so, like renjith.nair said, as long as your core infrastructure is all running the same version, you'll be fine.

I've worked with customers that were running 6.6.3 and then upgraded them to 7.0.3 and everything is fine.

Do note, that if you are running premium applications like ITSI or ES, certain older versions of those apps are not compatible with 7.x and you have to upgrade those components as well.

[renjith_nair · Accepted solution]

Hi @lksridhar ,

As long as you use the "same" version of Splunk , it does not trouble you in terms of compatibility. For different versions, compatibility information is available in
http://docs.splunk.com/Documentation/Forwarder/7.1.2/Forwarder/Compatibilitybetweenforwardersandinde...
http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements#Splunk_Enterprise_versi...

However, as mentioned, since you are using same versions it shouldn't be a problem. Just have a look at the release notes of 7.0.0 and see if there are any fixes (known issues) in the latest versions and go for it.