topic Re: What is the UF upgrade compatibility? in Getting Data In

What is the UF upgrade compatibility?

jkrehrer22 — Mon, 15 Apr 2019 15:11:24 GMT

I need to upgrade a several forwarders that are running older versions such as 4.x and 5.x. to 7.x.

Our distributed environment is running at 7.1.4.

Do I need to upgrade the UF to 6.5.2 first? Or, can i upgrade straight to 7.1.4?

Re: What is the UF upgrade compatibility?

skalliger — Tue, 16 Apr 2019 13:43:48 GMT

You can always install the UF version you want to, as long as it's not newer thant the indexer's version . See here. Installing a newer UF is just an uninstall and reinstall or replacing the files.

Be sure to backup your local files in case of a complete uninstall like mentioned here for Windows or here for *NIX. Remember that the loadbalancing for UFs got optimised, take a look here in case you want to change a few things: configure loadbalancing.

Skalli

Re: What is the UF upgrade compatibility?

pruthvikrishnap — Tue, 16 Apr 2019 19:05:13 GMT

It completely depends on the version you are using on your indexers.
Below docs can help.
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Compatibilitybetweenforwardersandindexers

Re: What is the UF upgrade compatibility?

sloshburch — Wed, 29 May 2019 15:55:00 GMT

I recommend you do need to upgrade to 6.6 first to be safe.

While there is no declared issue with UF, this IS called out in the Splunk Enterprise manual.

In fact, for those instances older than 6.0 you may need to upgrade to 5 and then 6 and then 6.6 and then 7.3.

If the UF gets all of it's config from the Deployment Server, you may even consider uninstalling the UF and then installing the latest clean.