Multiple indexer versions

[jmheaton]

So we recently put in a few more indexers running 5.0 but our old indexers are running 4.3.1

When looking at the Search Job Inspector i see
DEBUG: [index01] Adjusting search for peers with version (4.3.1): new remote search = 'litsearch

Is this actually slowing down my search results by a large amount or is this something that can be ignored. I'm searching roughly 30 million events over the last 24 hours, usually returning about 3 million results after about 7 minutes.

My main question is:
Currently we are running 13 indexers, 5 search heads, 10k forwarders, 3 heavy forwarders

Are my search results returning rather slow because i am lacking the hardware?
Indexers and searchheads are running dual quad core xenon E5504's with 12 gig of ram each

[OL · Accepted solution]

I would probably suggest to upgrade to the latest 5.x for indexers and search heads that you can use the report acceleration for this search if this is supported for it (check documentation), you will see, it will be sooo fast 🙂

If not supported, try to see if you can optimise your search if this is also possible.

Regards,
Olivier

[bosburn_splunk]

As Oliver said having multiple versions in your environment will impact search speeds. For example, if your search heads are 5.0.x and your indexers are 4.x, you will not be able to leverage all the benefits of running 5.0.x.

If you can, get all your indexers up to the same revision.