Installation

Does order matter when upgrading Search Heads and Indexers?

I_am_Jeff
Communicator

I have 2 pooled search heads and 6 indexers. Currently all are on version 4.2.3. I'd like to upgrade to 4.3.4. To make the transition more transparent to my users I'd like to upgrade the indexers, then schedule time to upgrade my search heads.

As I said, my search heads are pooled. The upgrade document discussed upgrading the search heads first in this environment. Upgrade a Distributed Environment with Multiple Indexers and Pooled Search Heads If my search heads were not pooled, then the same document recommends upgrading the indexers first.

I understand that pooled search heads have to be running the same version. Can I could upgrade my indexers first? Can older (4.2.3), pooled search heads work with newer (4.3.4) indexers? Am I missing something obvious?

0 Karma
1 Solution

malmoore
Splunk Employee
Splunk Employee

Hi I am Jeff,

Unfortunately, the only supported upgrade path for a distributed Splunk environment with pooled search heads is to upgrade those search heads before you upgrade the indexers.

If you review "Cross-version compatibility", you'll see that 4.3.x search heads work with 4.2.x indexers, but with a performance and feature set penalty. We do not recommend running 4.2.x search heads against 4.3.x indexers because of the changes between 4.2 and 4.3.

It's a good idea to speak with someone in Splunk Support for additional guidance on your specific use case.

View solution in original post

malmoore
Splunk Employee
Splunk Employee

Hi I am Jeff,

Unfortunately, the only supported upgrade path for a distributed Splunk environment with pooled search heads is to upgrade those search heads before you upgrade the indexers.

If you review "Cross-version compatibility", you'll see that 4.3.x search heads work with 4.2.x indexers, but with a performance and feature set penalty. We do not recommend running 4.2.x search heads against 4.3.x indexers because of the changes between 4.2 and 4.3.

It's a good idea to speak with someone in Splunk Support for additional guidance on your specific use case.

I_am_Jeff
Communicator

Darn. I was hoping it was just the way the document was written. My indexers probably could handle a 30% CPU hit as they're underworked at present. Upgrading isn't that hard, but it appears pooling throws a monkey wrench into the process.

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...