Splunk Search

Subsearch doesn't work after upgrade to 4.3.6

lqiao
Explorer

Hi,

I have a search as follows:
query 1 [search query 2]

I find in the internet that Searches that contain subsearches do not return data in environments where search heads are running version 5.0.x and indexers are running version 4.3.x. To work around this issue, upgrade indexers to the same version as the search heads. (SPL-62457).

But our indexers are running version 4.3.5.2 and we upgraded search head to 4.3.6. Then the above search doesn't return any data any more. It works fine with search-head 4.3.5.2.

My problem is the same as known issue SPL-62457? If I upgrade indexer also to 4.3.6, this problem will disappear?

Thank you very much for your kink answer.
Lu

Tags (2)
0 Karma

lqiao
Explorer

I found an answer to my own question. This problem is a known issue for release 4.3.6. See below:

http://docs.splunk.com/Documentation/Splunk/4.3.6/ReleaseNotes/KnownIssues

•Searches that contain subsearches do not return data in environments where search heads are running version 4.3.6 and indexers are running prior to 4.3.6. To work around this issue, upgrade indexers to the same version as the search heads. (SPL-65120)

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...