topic Re: Universal Forwarder 8.0 upgrade path from 6.x in Getting Data In

Universal Forwarder 8.0 upgrade path from 6.x

smiejascott — Wed, 22 Jan 2020 17:18:21 GMT

We have a bunch of older 6.x universal forwarders that will be incompatible with an 8.0 Enterprise Splunk instance. Is there any reason I can't upgrade these directly to 8.0 or do they need to be upgraded to 7.x first? The upgrade documentation isn't really clear.

In my mind I can't see any reason that an intermediate upgrade would be needed for a UF, but I suppose there could be one.

Re: Universal Forwarder 8.0 upgrade path from 6.x

burwell — Wed, 22 Jan 2020 19:44:59 GMT

Hi. You should read https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/AboutupgradingREADTHISFIRST

This clearly says don't go from 6.x to 8.x universal forwarder. You need to go to version 7 first.

Re: Universal Forwarder 8.0 upgrade path from 6.x

burwell — Wed, 29 Jan 2020 22:16:38 GMT

@smiejascott Hi so be clear: This sentence was in the above docs.

Do not try to upgrade Splunk Enterprise or Splunk universal forwarders directly to version 8.0 from a version that is lower than 7.0.

Re: Universal Forwarder 8.0 upgrade path from 6.x

smiejascott — Thu, 30 Jan 2020 15:44:36 GMT

Got it. I had always figured that the UFs were pretty simplistic but obviously something else is going on.

Re: Universal Forwarder 8.0 upgrade path from 6.x

burwell — Thu, 30 Jan 2020 18:50:07 GMT

Great @smiejascott Want to accept the answer?