Can I have different versions of Splunk Enterprise in a distributed environment?

[dyeo]

Can I have different versions of Splunk Enterprise within the same Splunk distributed environment? i.e. could I have a non-clustered search head on 7.0.1 with another non-clustered search head on 7.1 and my clustered indexers on 7.0.1?

[CarsonZa]

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other. The search heads must run the same or a later version from the peer nodes. Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements

While not necessarily recommended i would say you are in the clear.

[pradeepkumarg · Accepted solution]

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other.

The search heads must run the same or a later version from the peer nodes.

Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

More details here

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements#Splunk_Enterprise_versi...

[dyeo]

I wanted to upgrade our version of Enterprise Security to 5.1 which requires 7.1, but we have other Splunk apps on other search heads that aren't officially supported on 7.1 yet.