Getting Data In

Can I have different versions of Splunk Enterprise in a distributed environment?

dyeo
Engager

Can I have different versions of Splunk Enterprise within the same Splunk distributed environment? i.e. could I have a non-clustered search head on 7.0.1 with another non-clustered search head on 7.1 and my clustered indexers on 7.0.1?

0 Karma
1 Solution

pradeepkumarg
Influencer

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other.

The search heads must run the same or a later version from the peer nodes.

Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

More details here

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements#Splunk_Enterprise_versi...

View solution in original post

0 Karma

CarsonZa
Contributor

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other. The search heads must run the same or a later version from the peer nodes. Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements

While not necessarily recommended i would say you are in the clear.

0 Karma

pradeepkumarg
Influencer

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other.

The search heads must run the same or a later version from the peer nodes.

Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

More details here

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements#Splunk_Enterprise_versi...

0 Karma

dyeo
Engager

I wanted to upgrade our version of Enterprise Security to 5.1 which requires 7.1, but we have other Splunk apps on other search heads that aren't officially supported on 7.1 yet.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...