Getting Data In
Highlighted

Can I have different versions of Splunk Enterprise in a distributed environment?

Engager

Can I have different versions of Splunk Enterprise within the same Splunk distributed environment? i.e. could I have a non-clustered search head on 7.0.1 with another non-clustered search head on 7.1 and my clustered indexers on 7.0.1?

0 Karma
Highlighted

Re: Can I have different versions of Splunk Enterprise in a distributed environment?

Engager

I wanted to upgrade our version of Enterprise Security to 5.1 which requires 7.1, but we have other Splunk apps on other search heads that aren't officially supported on 7.1 yet.

0 Karma
Highlighted

Re: Can I have different versions of Splunk Enterprise in a distributed environment?

Influencer

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other.

The search heads must run the same or a later version from the peer nodes.

Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

More details here

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements#Splunk_Enterprise_versi...

View solution in original post

0 Karma
Highlighted

Re: Can I have different versions of Splunk Enterprise in a distributed environment?

Contributor

Compatibility between peer nodes and search heads
Starting with 6.3, the peer nodes and search heads can run different versions from each other. The search heads must run the same or a later version from the peer nodes. Search head clusters participating in an indexer cluster have the same compatibility requirements as individual search heads. For information on other search head cluster version requirements, see "System requirements and other deployment considerations for search head clusters" in the Distributed Search manual.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Systemrequirements

While not necessarily recommended i would say you are in the clear.

0 Karma