Upgrade Splunk Deployment

malopez_riv — Tue, 09 Feb 2021 00:32:01 GMT

Hi!

I´m looking for your help because I want to upgrade my Splunk deployment. Currently, I have all my forwarders running with the 6.2.3 version (my forwarders are running FreeBSD OS), my indexer and search head are running the 7.3 version (Those devices running in CentOS 11.2). The big question here, can I update my indexer and search head device to the 8.1.0.1 and mantain my forwarders in the 6.2.3 version? will the forwarders send events to the indexer without problem?

I'm considering two scenarios for my upgrade:

Forwarders in version 6.2.3 -> Indexer in version 8.1.0.1 -> Search Head in version 8.1.0.1

Forwarders in version 6.2.3 -> Indexer in version 7.2.3 -> Search Head in version 8.1.0.1

What do you think guys?

I really appreciate any help that you can bring me!!

Re: Upgrade Splunk Deployment

richgalloway — Tue, 09 Feb 2021 01:21:04 GMT

Can't do it. Splunk 8.x doesn't support forwarders that old. See https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwardersandindexers

You could keep the old indexers, but the 8.x search heads won't be able to take advantage of all of the new 8.x features.

topic Re: Upgrade Splunk Deployment in Deployment Architecture

Upgrade Splunk Deployment

Re: Upgrade Splunk Deployment