Installation

Does order matter when upgrading Search Heads and Indexers?

I_am_Jeff
Communicator

I have 2 pooled search heads and 6 indexers. Currently all are on version 4.2.3. I'd like to upgrade to 4.3.4. To make the transition more transparent to my users I'd like to upgrade the indexers, then schedule time to upgrade my search heads.

As I said, my search heads are pooled. The upgrade document discussed upgrading the search heads first in this environment. Upgrade a Distributed Environment with Multiple Indexers and Pooled Search Heads If my search heads were not pooled, then the same document recommends upgrading the indexers first.

I understand that pooled search heads have to be running the same version. Can I could upgrade my indexers first? Can older (4.2.3), pooled search heads work with newer (4.3.4) indexers? Am I missing something obvious?

0 Karma
1 Solution

malmoore
Splunk Employee
Splunk Employee

Hi I am Jeff,

Unfortunately, the only supported upgrade path for a distributed Splunk environment with pooled search heads is to upgrade those search heads before you upgrade the indexers.

If you review "Cross-version compatibility", you'll see that 4.3.x search heads work with 4.2.x indexers, but with a performance and feature set penalty. We do not recommend running 4.2.x search heads against 4.3.x indexers because of the changes between 4.2 and 4.3.

It's a good idea to speak with someone in Splunk Support for additional guidance on your specific use case.

View solution in original post

malmoore
Splunk Employee
Splunk Employee

Hi I am Jeff,

Unfortunately, the only supported upgrade path for a distributed Splunk environment with pooled search heads is to upgrade those search heads before you upgrade the indexers.

If you review "Cross-version compatibility", you'll see that 4.3.x search heads work with 4.2.x indexers, but with a performance and feature set penalty. We do not recommend running 4.2.x search heads against 4.3.x indexers because of the changes between 4.2 and 4.3.

It's a good idea to speak with someone in Splunk Support for additional guidance on your specific use case.

View solution in original post

I_am_Jeff
Communicator

Darn. I was hoping it was just the way the document was written. My indexers probably could handle a 30% CPU hit as they're underworked at present. Upgrading isn't that hard, but it appears pooling throws a monkey wrench into the process.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!