Getting Data In

Can I have different versions of Splunk Enterprise in a distributed environment?

dyeo
Engager

Can I have different versions of Splunk Enterprise within the same Splunk distributed environment? i.e. could I have a non-clustered search head on 7.0.1 with another non-clustered search head on 7.1 and my clustered indexers on 7.0.1?

0 Karma
1 Solution

pradeepkumarg
Influencer

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other.

The search heads must run the same or a later version from the peer nodes.

Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

More details here

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements#Splunk_Enterprise_versi...

View solution in original post

0 Karma

CarsonZa
Contributor

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other. The search heads must run the same or a later version from the peer nodes. Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements

While not necessarily recommended i would say you are in the clear.

0 Karma

pradeepkumarg
Influencer

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other.

The search heads must run the same or a later version from the peer nodes.

Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

More details here

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements#Splunk_Enterprise_versi...

View solution in original post

0 Karma

dyeo
Engager

I wanted to upgrade our version of Enterprise Security to 5.1 which requires 7.1, but we have other Splunk apps on other search heads that aren't officially supported on 7.1 yet.

0 Karma