Splunk Search

Multiple indexer versions

jmheaton
Path Finder

So we recently put in a few more indexers running 5.0 but our old indexers are running 4.3.1

When looking at the Search Job Inspector i see
DEBUG: [index01] Adjusting search for peers with version (4.3.1): new remote search = 'litsearch

Is this actually slowing down my search results by a large amount or is this something that can be ignored. I'm searching roughly 30 million events over the last 24 hours, usually returning about 3 million results after about 7 minutes.

My main question is:
Currently we are running 13 indexers, 5 search heads, 10k forwarders, 3 heavy forwarders

Are my search results returning rather slow because i am lacking the hardware?
Indexers and searchheads are running dual quad core xenon E5504's with 12 gig of ram each

Tags (1)
1 Solution

OL
Communicator

I would probably suggest to upgrade to the latest 5.x for indexers and search heads that you can use the report acceleration for this search if this is supported for it (check documentation), you will see, it will be sooo fast 🙂

If not supported, try to see if you can optimise your search if this is also possible.

Regards,
Olivier

View solution in original post

OL
Communicator

I would probably suggest to upgrade to the latest 5.x for indexers and search heads that you can use the report acceleration for this search if this is supported for it (check documentation), you will see, it will be sooo fast 🙂

If not supported, try to see if you can optimise your search if this is also possible.

Regards,
Olivier

View solution in original post

bosburn_splunk
Splunk Employee
Splunk Employee

As Oliver said having multiple versions in your environment will impact search speeds. For example, if your search heads are 5.0.x and your indexers are 4.x, you will not be able to leverage all the benefits of running 5.0.x.

If you can, get all your indexers up to the same revision.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!