CM and IDX Different Splunk Enterprise Versions?

[SplunkNinja]

One of my colleagues said we could be running different Splunk Enterprise versions on the CM and IDX Cluster.  For example, he said that we could run the IDX Cluster at Splunk 9.0.x and the CM at Splunk 8.1.x.  

This does not sound like a Splunk best practice to me.  But is it technically possible?  Do all Indexers need to be running the same version of Splunk?

[richgalloway · Accepted solution]

Technically, just about anything is possible, but perhaps not advisable.  Running a CM with an older version than the indexers falls into the latter category.  It can be done (and I've heard of customers doing so), but it's an unsupported configuration.  If they can't be the same then the CM should be newer.

Yes, all indexers should run the same version of Splunk (except during an upgrade).