topic Splunk Universal Forwarder Compatibility to Splunk Indexer 8.0.2 in Getting Data In

Splunk Universal Forwarder Compatibility to Splunk Indexer 8.0.2

gebr — Tue, 26 Sep 2023 12:26:34 GMT

Hi,

in the official compatibility matrix there is no column for Indexer 8.0.x anymore as its no longer supported.

https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwardersandindexers

Does anyone know up to which version of the Universal Forwarder is compatibel with an 8.0.x Indexer (with an 8.0.x Heavy Forwarder infront) ?

Re: Splunk Universal Forwarder Compatibility to Splunk Indexer 8.0.2

SanjayReddy — Tue, 26 Sep 2023 15:15:13 GMT

Hi @gebr

As 8.0.x no longer supporrted by splunk as per support policy from https://www.splunk.com/en_us/legal/splunk-software-support-policy.html#core

I would suggest to upgarde your infra to last version of Splunk. e.g 9.0.x.

if you are not able to upgrade for sometime ,

may be i would suggest to go for 8.0.1 splunk UF or same version as HF/Indexer

you can download from older version from https://www.splunk.com/en_us/download/previous-releases-universal-forwarder.html

Re: Splunk Universal Forwarder Compatibility to Splunk Indexer 8.0.2

PickleRick — Tue, 26 Sep 2023 18:56:39 GMT

Ok. So your whole environment is not supported anymore so if it works, it works but if it doesn't noone will officially help you. Having said that - any relatively modern (7.0+) forwarder should work. If you use 9.x forwarders you'll have to disable configtracker input because you don't have corresponding index on 8.x indexers and the events would generate warning and possibly go to your last resort index if you have one configured.