Splunk Search

Multiple indexer versions

jmheaton
Path Finder

So we recently put in a few more indexers running 5.0 but our old indexers are running 4.3.1

When looking at the Search Job Inspector i see
DEBUG: [index01] Adjusting search for peers with version (4.3.1): new remote search = 'litsearch

Is this actually slowing down my search results by a large amount or is this something that can be ignored. I'm searching roughly 30 million events over the last 24 hours, usually returning about 3 million results after about 7 minutes.

My main question is:
Currently we are running 13 indexers, 5 search heads, 10k forwarders, 3 heavy forwarders

Are my search results returning rather slow because i am lacking the hardware?
Indexers and searchheads are running dual quad core xenon E5504's with 12 gig of ram each

Tags (1)
1 Solution

OL
Communicator

I would probably suggest to upgrade to the latest 5.x for indexers and search heads that you can use the report acceleration for this search if this is supported for it (check documentation), you will see, it will be sooo fast :slightly_smiling_face:

If not supported, try to see if you can optimise your search if this is also possible.

Regards,
Olivier

View solution in original post

OL
Communicator

I would probably suggest to upgrade to the latest 5.x for indexers and search heads that you can use the report acceleration for this search if this is supported for it (check documentation), you will see, it will be sooo fast :slightly_smiling_face:

If not supported, try to see if you can optimise your search if this is also possible.

Regards,
Olivier

bosburn_splunk
Splunk Employee
Splunk Employee

As Oliver said having multiple versions in your environment will impact search speeds. For example, if your search heads are 5.0.x and your indexers are 4.x, you will not be able to leverage all the benefits of running 5.0.x.

If you can, get all your indexers up to the same revision.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...