topic Re: Can a heavy forwarder be higher version than indexers? in Getting Data In

Can a heavy forwarder be higher version than indexers?

a_naoum — Wed, 24 Apr 2019 12:07:01 GMT

Hi,

I don't think that I found this kind of question before but in general I know the case for different versions between the indexers-search heads but my question is:
Can a heavy forwarder be higher version than indexers?

Re: Can a heavy forwarder be higher version than indexers?

kamlesh_vaghela — Wed, 24 Apr 2019 12:15:19 GMT

@a_naoum

Check "Determine forwarder-indexer compatibility" section in below link.

https://docs.splunk.com/Documentation/Forwarder/7.2.6/Forwarder/Compatibilitybetweenforwardersandindexers

Re: Can a heavy forwarder be higher version than indexers?

VatsalJagani — Wed, 24 Apr 2019 12:16:23 GMT

Hi @a_naoum,

Indexer should be in higher version than the forwarder, please visit Forwarder Compatibility.

Re: Can a heavy forwarder be higher version than indexers?

sanjeev543 — Wed, 24 Apr 2019 12:17:24 GMT

Technically yes, but there are limitations on what kind of Data forwarder can send, if you maintain higher version of HF.
Please refer to the below compatibility matrix.
https://docs.splunk.com/Documentation/Forwarder/7.2.6/Forwarder/Compatibilitybetweenforwardersandindexers

Re: Can a heavy forwarder be higher version than indexers?

harsmarvania57 — Wed, 24 Apr 2019 12:56:30 GMT

I would like to point out that question is for Heavy Forwarder, however Forwarder compatibility link which is provided in answer is for Comparability between Universal Forwarder and Splunk Indexer.

Heavy Forwarder is same as Splunk Indexer (Search Peer), only difference is Heavy Forwarder do not store data in general and pass parsed data to Indexer so based on my knowledge this is correct link from doc https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Systemrequirements#Compatibility_between_peer_nodes for compatibility between Heavy Forwarder and Indexer, please correct me if I am wrong.

Re: Can a heavy forwarder be higher version than indexers?

a_naoum — Fri, 26 Apr 2019 12:49:29 GMT

As others mention is it applicable for HF?

Re: Can a heavy forwarder be higher version than indexers?

pellegrini — Fri, 26 May 2023 08:59:01 GMT

Yes it is applicable for standard HF functionality as well. At least according to Docs. Some special cases where the HF is configured differently then just forward events it might be different.

https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwardersandindexers

Re: Can a heavy forwarder be higher version than indexers?

isoutamo — Fri, 26 May 2023 09:19:57 GMT

Officially this is not a supported combination. Indexer should/must be at higher level to fulfil Splunk requirements and get support if needed. Best practices is ensure that receiver is at least same level than sender.

Fortunately in most cases HFs and UFs can be higher level than IDX is. Normally this work well but time by time (when newer versions has some new features) this will cause some issues and even those didn't work together without additional changes on configuration.

r. Ismo