topic Re: Splunk upgrade to 9 in Splunk Enterprise

Splunk upgrade to 9- Is UF 7.1.0 compatible?

guruprasad — Tue, 13 Sep 2022 23:48:24 GMT

Hello,

I have a plan to upgrade spunk to version 9.* from 8.2, but we are using Splunk Universal Forwarder 7.1.0. Splunk enterprise will be compatible with Splunk Universal Forwarder 7.1.0 or do we have to upgrade Splunk Universal Forwarder to version 9.*?

Re: Splunk upgrade to 9

chaker — Tue, 13 Sep 2022 23:47:36 GMT

7.x is supported, but only just.

https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwardersandindexers

Re: Splunk upgrade to 9

guruprasad — Tue, 13 Sep 2022 23:55:59 GMT

Can we upgrade Splunk to version 9.* without upgrading Splunk forwarder?

Re: Splunk upgrade to 9

chaker — Wed, 14 Sep 2022 00:01:00 GMT

Yes, for events and metrics.

If you have HEC/HTTPOUT requirements, then you should upgrade the UF tier after the indexers are upgraded.

Re: Splunk upgrade to 9

guruprasad — Wed, 14 Sep 2022 00:06:46 GMT

we have 100 windows machines, how to upgrade UF on all machines?

Re: Splunk upgrade to 9

chaker — Wed, 14 Sep 2022 00:11:38 GMT

There is no Splunk solution for UF upgrade managment, however it may be added into Splunk in future.

There is a script below that you can adapt and use, but it comes with no support. You may also consider SCCM for upgrading the UF, or Puppet for example.

https://community.splunk.com/t5/Getting-Data-In/What-script-should-I-use-to-upgrade-multiple-universal/m-p/467915