Does order matter when upgrading Search Heads and Indexers?

[I_am_Jeff]

I have 2 pooled search heads and 6 indexers. Currently all are on version 4.2.3. I'd like to upgrade to 4.3.4. To make the transition more transparent to my users I'd like to upgrade the indexers, then schedule time to upgrade my search heads.

As I said, my search heads are pooled. The upgrade document discussed upgrading the search heads first in this environment. Upgrade a Distributed Environment with Multiple Indexers and Pooled Search Heads If my search heads were not pooled, then the same document recommends upgrading the indexers first.

I understand that pooled search heads have to be running the same version. Can I could upgrade my indexers first? Can older (4.2.3), pooled search heads work with newer (4.3.4) indexers? Am I missing something obvious?

[malmoore · Accepted solution]

Hi I am Jeff,

Unfortunately, the only supported upgrade path for a distributed Splunk environment with pooled search heads is to upgrade those search heads before you upgrade the indexers.

If you review "Cross-version compatibility", you'll see that 4.3.x search heads work with 4.2.x indexers, but with a performance and feature set penalty. We do not recommend running 4.2.x search heads against 4.3.x indexers because of the changes between 4.2 and 4.3.

It's a good idea to speak with someone in Splunk Support for additional guidance on your specific use case.

[I_am_Jeff]

Darn. I was hoping it was just the way the document was written. My indexers probably could handle a 30% CPU hit as they're underworked at present. Upgrading isn't that hard, but it appears pooling throws a monkey wrench into the process.