Getting Data In

Can I have different versions of Splunk Enterprise in a distributed environment?

dyeo
Engager

Can I have different versions of Splunk Enterprise within the same Splunk distributed environment? i.e. could I have a non-clustered search head on 7.0.1 with another non-clustered search head on 7.1 and my clustered indexers on 7.0.1?

0 Karma
1 Solution

pradeepkumarg
Influencer

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other.

The search heads must run the same or a later version from the peer nodes.

Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

More details here

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements#Splunk_Enterprise_versi...

View solution in original post

0 Karma

CarsonZa
Contributor

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other. The search heads must run the same or a later version from the peer nodes. Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements

While not necessarily recommended i would say you are in the clear.

0 Karma

pradeepkumarg
Influencer

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other.

The search heads must run the same or a later version from the peer nodes.

Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

More details here

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements#Splunk_Enterprise_versi...

0 Karma

dyeo
Engager

I wanted to upgrade our version of Enterprise Security to 5.1 which requires 7.1, but we have other Splunk apps on other search heads that aren't officially supported on 7.1 yet.

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...