Which of the following are true statements about Splunk indexer clustering?

Version-compatibility rules for indexer clusters require that the cluster-master (manager) run the same or a later release than its peer indexers, while search heads may run the same release as, or one release newer than, the peer indexers. Peer nodes are only required to be on a supported release—not necessarily identical—and they must not be newer than the master. Hence, only statement D is correct.

A. Peers should run compatible versions but need not be identical.

B. Search heads can be the same or newer than the master; master need not be newest.

C. Peers cannot be newer than the master; rule is reversed.

D. Correct.

1. Splunk Enterprise Distributed Search Manual > Indexer Clustering > “Version compatibility between cluster nodes” (Splunk 9.0, Table 1).

2. Splunk Release Notes > “Upgrade path and mixed-version support for indexer clusters” (Splunk 9.1, §Cluster version matrix).