Installation

Does order matter when upgrading Search Heads and Indexers?

I_am_Jeff
Communicator

I have 2 pooled search heads and 6 indexers. Currently all are on version 4.2.3. I'd like to upgrade to 4.3.4. To make the transition more transparent to my users I'd like to upgrade the indexers, then schedule time to upgrade my search heads.

As I said, my search heads are pooled. The upgrade document discussed upgrading the search heads first in this environment. Upgrade a Distributed Environment with Multiple Indexers and Pooled Search Heads If my search heads were not pooled, then the same document recommends upgrading the indexers first.

I understand that pooled search heads have to be running the same version. Can I could upgrade my indexers first? Can older (4.2.3), pooled search heads work with newer (4.3.4) indexers? Am I missing something obvious?

0 Karma
1 Solution

malmoore
Splunk Employee
Splunk Employee

Hi I am Jeff,

Unfortunately, the only supported upgrade path for a distributed Splunk environment with pooled search heads is to upgrade those search heads before you upgrade the indexers.

If you review "Cross-version compatibility", you'll see that 4.3.x search heads work with 4.2.x indexers, but with a performance and feature set penalty. We do not recommend running 4.2.x search heads against 4.3.x indexers because of the changes between 4.2 and 4.3.

It's a good idea to speak with someone in Splunk Support for additional guidance on your specific use case.

View solution in original post

malmoore
Splunk Employee
Splunk Employee

Hi I am Jeff,

Unfortunately, the only supported upgrade path for a distributed Splunk environment with pooled search heads is to upgrade those search heads before you upgrade the indexers.

If you review "Cross-version compatibility", you'll see that 4.3.x search heads work with 4.2.x indexers, but with a performance and feature set penalty. We do not recommend running 4.2.x search heads against 4.3.x indexers because of the changes between 4.2 and 4.3.

It's a good idea to speak with someone in Splunk Support for additional guidance on your specific use case.

I_am_Jeff
Communicator

Darn. I was hoping it was just the way the document was written. My indexers probably could handle a 30% CPU hit as they're underworked at present. Upgrading isn't that hard, but it appears pooling throws a monkey wrench into the process.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...