That would not work. The search head must be at the same or a higher level than the search peers. See the note later in this section for a precise definition of "level" in this context. This holds true for both clustered and standalone search heads. See this for more details https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Distsearchsystemrequirements#Compatibility_between_search_heads_and_search_peers https://answers.splunk.com/answers/484456/using-different-splunk-version-for-search-head-clu.html ... View more