topic Re: upgrade from 9.3.8 to 10.0.2 in Splunk Enterprise

upgrade from 9.3.8 to 10.0.2

gitau_gm — Mon, 15 Dec 2025 21:35:23 GMT

What is the correct position on upgrading UFs from 9.3.8 to 10.0.2?

Re: upgrade from 9.3.8 to 10.0.2

inventsekar — Tue, 16 Dec 2025 02:36:30 GMT

Hi @gitau_gm

First things first....1) what is the indexer version?

Determining forwarder-indexer compatibility is important

2) only few UF's or high number of UF's?

if only few, you can manually plan to upgrade. high number of UF's require more manual task or some automatic upgrades can be planned.

document for y(our) reference:

https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates/compatibility-matrix/splunk-products-version-compatibility/compatibility-between-forwarders-and-splunk-enterprise-indexers

Forwarder version Splunk Enterprise indexer version

	9.2.x	9.3.x	9.4.x	10.0.x
8.1.x	E, H, M	E, H, M	E, H, M	E, H, M
8.2.x	E, H, M	E, H, M	E, H, M	E, H, M
9.0.x	E, H, M	E, H, M	E, H, M	E, H, M
9.1.x	E, H, M	E, H, M	E, H, M	E, H, M
9.2.x	E, H, M	E, H, M	E, H, M	E, H, M
9.3.x	E, H, M	E, H, M	E, H, M	E, H, M
9.4.x	E, H, M	E, H, M	E, H, M	E, H, M
10.0.x	E, H, M	E, H, M	E, H, M	E, H, M

E - Events. This version of forwarder can send event data to the corresponding version of indexer.
H - HTTPOUT. This version of forwarder can send event data from Splunk instance to Splunk instance (S2S) over Hypertext Transfer Protocol Secure (HTTPS).
M - Metrics. This version of forwarder can send both event data and metrics data to the corresponding version of indexer.

Re: upgrade from 9.3.8 to 10.0.2

gitau_gm — Tue, 16 Dec 2025 13:18:19 GMT

@inventsekar Thank you for this. I think the right question ought to have been, about going directly to v10.0.2 from pre 9.4.x versions. I have a few hundred ufs at 9.3.8. Can I go directly to 10.0.2?

Re: upgrade from 9.3.8 to 10.0.2

inventsekar — Tue, 16 Dec 2025 13:32:03 GMT

Hi @gitau_gm

i think from 9.3.8, you should upgrade to 9.4, then 9.4 to 10.0.2

Docs for your reference:

Splunk supports a direct upgrade from UF 9.4.x and higher to UF 10.0.

https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/10.0/upgrade-or-migrate-splunk-enterprise/about-upgrading-to-10.0-read-this-first

for linux UF's there is a remote upgrader solution available, pls check it:

https://help.splunk.com/en/splunk-enterprise/forward-and-process-data/splunk-remote-upgrader-for-linux-universal-forwarders/9.4/about-the-splunk-remote-upgrader-for-linux-universal-forwarders/about-the-splunk-remote-upgrader-for-linux-universal-forwarders

if this solves your query, pls accept it as solution. karma points appreciated, thanks.

Re: upgrade from 9.3.8 to 10.0.2

gitau_gm — Tue, 16 Dec 2025 15:37:56 GMT

Thank you very much @inventsekar

Re: upgrade from 9.3.8 to 10.0.2

livehybrid — Tue, 16 Dec 2025 16:49:20 GMT

Hi @gitau_gm

From experience, and from the Docs (https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/10.0/upgrade-or-migrate-splunk-enterprise/how-to-upgrade-splunk-enterprise) I have had no issues going from 9.3.x to 10.0.x

The upgrade docs above state you can go from 9.3.x to the latest 10.0.x version without needing to upgrade to 9.4.x first.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: upgrade from 9.3.8 to 10.0.2

inventsekar — Wed, 17 Dec 2025 12:49:11 GMT

Hi @livehybrid ,

>>> The upgrade docs above state you can go from 9.3.x to the latest 10.0.x version without needing to upgrade to 9.4.x first <<<

the above mentioned upgrade docs is for Splunk Enterprise i think(user is asking about UF, not Splunk Enterprise). and also i could not find where it says you can go from 9.3.x to latest 10.0.x, could you pls clarify, thanks.