topic Re: What is the forwarder to indexer compatibility matrix? in Getting Data In

What is the forwarder to indexer compatibility matrix?

Simeon — Mon, 19 Apr 2010 23:31:33 GMT

I have a mixed environment of forwarders and indexers (3.4, 4.0, and 4.1) and I would like to know which versions are supported/compatible with each other. For example, can I run a 3.x forwarder with 4.1 indexer? On the flip side, can I run a 4.1 forwarder with a 4.0 indexer?

Re: What is the forwarder to indexer compatibility matrix?

Simeon — Mon, 19 Apr 2010 23:35:25 GMT

Splunk indexers are backwards compatible with older versions of the forwarder. However, Splunk forwarders are not backwards compatible with older versions of the indexer. For example, the following environments are supported:

3.4 Splunk Forwarder >> 4.0 Splunk Indexer
4.0 Splunk Forwarder >> 4.1 Splunk Indexer
3.4 Splunk Forwarder >> 4.1 Splunk Indexer

Re: What is the forwarder to indexer compatibility matrix?

gkanapathy — Thu, 24 Mar 2011 04:14:24 GMT

This information is no longer valid. The compatibility matrix has been expanded. See http://www.splunk.com/base/Documentation/5.0/Deploy/Enableareceiver#Compatibility_between_forwarders_and_indexers

Re: What is the forwarder to indexer compatibility matrix?

gkanapathy — Thu, 24 Mar 2011 04:17:48 GMT

Forwarders can always send to newer versions of indexers, as indicated in Simeon's answer. In addition, all 4.0, 4.1, and 4.2 forwarders can send to any indexer with version 3.4.14 or higher. Thus, any 4.x forwarder can talk to any 4.x indexer (as well as 3.4.14 indexers).

See: http://www.splunk.com/base/Documentation/5.0/Deploy/Enableareceiver#Compatibility_between_forwarders_and_indexers

Re: What is the forwarder to indexer compatibility matrix?

alexander_lucas — Wed, 11 Jan 2012 02:55:32 GMT

what is the updated case for 4.3?

Re: What is the forwarder to indexer compatibility matrix?

sberg — Tue, 30 Oct 2012 15:36:15 GMT

So, wait a sec... does a 4.3.3 uni forwarder >> 4.3.2 indexer work?

The 4.3.2 forwarder for windows has a serious bug and I'm trying to figure out if upgrading or downgrading is the best option for the 50+ forwarders I have in use.

The bug... http://splunk-base.splunk.com/answers/47535/wineventlog-on-windows-2008-and-splunk-432-forwarders-splunk-could-not-get-the-description-for-this-event

Re: What is the forwarder to indexer compatibility matrix?

sberg — Tue, 30 Oct 2012 18:09:55 GMT

To answer my own question. Yes.

Installed 4.3.4 universal forwarder (x64 variety on WinServer2008) and all is well reporting to 4.3.2 indexer.

Re: What is the forwarder to indexer compatibility matrix?

Jon_Webster — Wed, 09 Jan 2013 06:00:23 GMT

To be clear and make it easy, text below is from gkanapahty's link above:

4.2+/5.0+ forwarders (universal/light/heavy) are backwards compatible down to 4.2+ indexers. For example, a 4.3 forwarder can send data to a 4.2 indexer but not to a 4.1 indexer. 

Pre-4.2 forwarders are backwards compatible down to 4.0 indexers. 

All indexers are backwards compatible with any forwarder and can receive data from any earlier version forwarder. For example, a 4.2 indexer can receive data from a 4.1 forwarder.

Re: What is the forwarder to indexer compatibility matrix?

bwooden — Mon, 21 Oct 2013 14:54:11 GMT

6.0 update from http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Compatibilitybetweenforwardersandindexers

6.0 forwarders (universal/light/heavy) are backwards compatible down to 4.2+ indexers. For example, a 6.0 forwarder can send data to a 4.2 indexer but not to a 4.1 indexer.
6.0 indexers are backwards compatible with forwarders down to 4.x.

The following 6.0 features are available only if both indexers and forwarders are at version 6.0 or higher:
* Dynamic file headers
* Timezone extraction on the forwarder

Re: What is the forwarder to indexer compatibility matrix?

kmjefferson42 — Tue, 20 Mar 2018 20:52:50 GMT

Can the latest version of the Universal Forwarder send to older version of Splunk Indexer? Specifically v5.6??
I would not think there would be a problem but need to verify.

Thank you,