https://community.splunk.com/t5/Deployment-Architecture/upgrade-splunk-forwarder/m-p/197293#M23629 <P>Hello</P> <P>You should upgrade at least to version 5.x</P> <PRE><CODE>6.x indexers are backwards compatible with forwarders down to 5.0.x. </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Compatibilitybetweenforwardersandindexers">http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Compatibilitybetweenforwardersandindexers</A></P> <P>And, as a best practice you should have them in 6.x</P> <PRE><CODE>As a best practice, it is recommended that indexers be at the same or higher version level than the forwarders they're receiving data from. </CODE></PRE> <P>Regards</P> Fri, 07 Nov 2014 08:15:12 GMT gfuente 2014-11-07T08:15:12Z https://community.splunk.com/t5/Deployment-Architecture/upgrade-splunk-forwarder/m-p/197292#M23628 <P>Hi there, i am upgrading my splunk server to version 6. however, i have multiple splunk forwarders (abt 300) in different versions, from v4.x to v6.</P> <P>i know other has asked something similar before. if i am going to choose one version, which one will it be ?</P> <P>thanks in advance.</P> Fri, 07 Nov 2014 08:10:29 GMT https://community.splunk.com/t5/Deployment-Architecture/upgrade-splunk-forwarder/m-p/197292#M23628 watzson 2014-11-07T08:10:29Z https://community.splunk.com/t5/Deployment-Architecture/upgrade-splunk-forwarder/m-p/197293#M23629 <P>Hello</P> <P>You should upgrade at least to version 5.x</P> <PRE><CODE>6.x indexers are backwards compatible with forwarders down to 5.0.x. </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Compatibilitybetweenforwardersandindexers">http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Compatibilitybetweenforwardersandindexers</A></P> <P>And, as a best practice you should have them in 6.x</P> <PRE><CODE>As a best practice, it is recommended that indexers be at the same or higher version level than the forwarders they're receiving data from. </CODE></PRE> <P>Regards</P> Fri, 07 Nov 2014 08:15:12 GMT https://community.splunk.com/t5/Deployment-Architecture/upgrade-splunk-forwarder/m-p/197293#M23629 gfuente 2014-11-07T08:15:12Z