Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- "Encountered an error deserializing SearchResultsI...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a Search head running Splunk 6.1.5 (can't currently upgrade) and it is trying to search an indexer cluster running on 6.2.4.
It errors out for these particular peers with the error:
08-12-2015 15:11:18.120 ERROR ResultsStream - Encountered an error deserializing SearchResultsInfo from ResultsStream header.
Checking the remote logs from the search peers and there are no errors at all. It's only on the search head.
I've tried readding the cluster master to the search head (removing it, restarting then adding it again) and I get the same issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Turns out that this is an unsupported configuration.
Documentation has been updated to reflect the supported version relationships between cluster master, search heads and indexers.
Info here : http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Systemrequirements#Splunk_Enterprise_versi...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Turns out that this is an unsupported configuration.
Documentation has been updated to reflect the supported version relationships between cluster master, search heads and indexers.
Info here : http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Systemrequirements#Splunk_Enterprise_versi...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Getting the exact same error, but our search head and indexer are the same version. The search head member in our case is having difficulty getting the cluster config from the captain.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have encountered the same issue, search a Splunk indexer 6.3.3 and Splunk indexer 6.1.4 with a 6.1.4 search head. Is this a bug or configuration error?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
same problem in 6.3.1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same Problem as well on 6.3.1
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
Fun with Regular Expression - multiples of nine
