Deployment Architecture

How can I resolve this error I get from adding a new search head to my indexer clustering environment?

daniel_splunk
Splunk Employee
Splunk Employee

After I added a new search head to my indexer cluster environment, I started getting "Error = 'Couldn't deserialize, err=Deserialization failed parsing unsigned long long"

The searchhead is unable to update the peer information. Error = 'Couldn't deserialize, err=Deserialization failed parsing unsigned long long. key=num_buckets not found in json={"cluster_label":"00000000-0000-0000-0000-000000000001","eai:acl":null,"generation_id":839,"generation_peers":
0 Karma
1 Solution

daniel_splunk
Splunk Employee
Splunk Employee

You are getting that error because Splunk has strict versioning requirements within indexer clustering.

The cluster Master Node version must be greater than or equal to the Search Head.
The Search Head version must be greater than or equal to Search Peers.
ie. CM version => SH version => peers version

View solution in original post

daniel_splunk
Splunk Employee
Splunk Employee

You are getting that error because Splunk has strict versioning requirements within indexer clustering.

The cluster Master Node version must be greater than or equal to the Search Head.
The Search Head version must be greater than or equal to Search Peers.
ie. CM version => SH version => peers version

Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...