Which of the following are true statements about Splunk indexer clustering?

Question

Options

• AAll peer nodes must run exactly the same Splunk version.
• BThe master node must run the same or a later Splunk version than search heads.
• CThe peer nodes must run the same or a later Splunk version than the master node.
• DThe search head must run the same or a later Splunk version than the peer nodes.

Explanation

D is correct. In Splunk indexer clustering, the search head must run the same or a later version than the peer (indexer) nodes. This ensures the search head can properly interpret and process data returned by the peers - a newer search head is always backward-compatible with older peer nodes, but not vice versa.

Why the others are wrong:

• A is false - Splunk supports rolling upgrades, which means peer nodes can temporarily run different versions during an upgrade window; they are not required to all be identical.
• B reverses the actual documented relationship; there is no requirement that the master node be newer than the search head - both the master and search head must be ≥ the peer nodes, but they are not ranked against each other in this way.
• C is backwards - it's the master node that must run the same or later version than the peers, not the other way around. Running a newer peer against an older master would break cluster management.

Memory tip: Think of it as a "version hierarchy pointing down to the peers." Both the cluster master and the search head sit above the peer nodes in version requirements - they must be same or newer than the peers. Peers are always at the bottom of the version chain, never above either control layer.

No community discussion yet for this question.