Hi @Abass42 From my experience you can run a Splunk cluster (indexer or search head) with a mix of RHEL 7 and RHEL 8 hosts, including having your cluster manager on RHEL 8 while some peers remain o...
See more...
Hi @Abass42 From my experience you can run a Splunk cluster (indexer or search head) with a mix of RHEL 7 and RHEL 8 hosts, including having your cluster manager on RHEL 8 while some peers remain on RHEL 7, as long as all Splunk nodes are running the same supported Splunk version. The underlying OS version does not affect Splunk clustering compatibility, provided both OS versions are supported by the Splunk version in use, although it becomes much more complicated if mis-matching underlying OS e.g. Windows Vs Linux! This is from a technical standpoint though, While mixed OS versions may be supported during migration periods, the recommended long-term state is to standardize all nodes in the cluster on the same, newer supported OS version. You run the risk of being in an un-supported state if you remain in a mixed version state. OS differences alone should not impact search or cluster management functionality, Splunk communicates via supported network protocols, not OS-specific mechanisms. You have possibly already seen this but its worth reviewing https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/9.2/plan-your-splunk-enterprise-installation/system-requirements-for-use-of-splunk-enterprise-on-premises I would also recommend that after migrating all nodes to RHEL 8, to revalidate ulimits etc. Avoid running mismatched Splunk software versions across cluster nodes/IDX where possible to avoid different performance across different nodes. If you use custom scripts or apps, validate their dependencies (Python, OS libraries) for OS compatibility. Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing