System requirements and other deployment considerations for distributed search

This topic describes the key considerations when deploying a basic distributed search topology with search heads that function independently of each other. If instead you are deploying a search head cluster, see System requirements and other deployment considerations for search head clusters.

Hardware requirements for distributed search instances

For information on the hardware requirements for search heads and search peers (indexers), see Reference hardware in the Capacity Planning Manual.

Operating system compatibility

A non-clustered distributed search deployment can include a combination of search heads and indexers running on any supported operating system. For example, you can use a combination of indexers running on different supported Linux operating systems. See Supported operating systems in the Installation Manual.

For search head cluster and indexer cluster deployments, each cluster node must be running on the same operating system and version. For more information on indexer cluster requirements, see System requirements and other deployment considerations for indexer clusters in Managing indexers and clusters of indexers.

Splunk Enterprise version compatibility

Upgrade search heads and search peers at the same time to take full advantage of the latest search capabilities. If you cannot do so, follow these version compatibility guidelines.

Compatibility between search heads and search peers

The following rules define compatibility requirements between search heads and search peers:

• All instances must be running supported versions of Splunk Enterprise.
• The search head must be at the same or a higher level than the search peers. See the note later in this section for a precise definition of "level" in this context.
• Supported versions of search heads and search peers are otherwise compatible with each other.

Note the following:

• These guidelines are valid for standalone search heads and for search heads that are participating in a search head cluster, if those search heads are sending requests to non-clustered indexers.
• Search heads participating in indexer clusters have different compatibility restrictions. See Splunk Enterprise version compatibility in Managing Indexers and Clusters of Indexers.
• Compatibility is significant at the major/minor release level, but not at the maintenance level. For example, an n.2 search head is not compatible with an n.3 search peer, because the n.2 search head is at a lower minor release level than the n.3 search peer. However, an n.3.1 search head is compatible with an n.3.3 search peer, despite the lower maintenance release level of the search head.

Licenses for distributed search

Each instance in a distributed search deployment must have access to a license pool. This is true for both search heads and search peers. See Licenses and distributed deployments in Admin Manual.

Synchronize system clocks across the distributed search environment

Synchronize the system clocks on all machines, virtual or physical, that are running Splunk Enterprise distributed search instances. Specifically, this means your search heads and search peers. In the case of mounted bundles, this also includes the shared storage hardware. Otherwise, various issues can arise, such as bundle replication failures, search failures, or premature expiration of search artifacts.

The synchronization method that you use depends on your specific set of machines. Consult the system documentation for the particular machines and operating systems on which you are running Splunk Enterprise. For most environments, Network Time Protocol (NTP) is the best approach.