topic Re: Splunk Hadoop Connector: will it work with version 4.x indexers? in Getting Data In

Splunk Hadoop Connector: will it work with version 4.x indexers?

the_wolverine — Fri, 18 Jan 2013 00:42:36 GMT

I realize the Splunk Hadoop Connector requires forwarder version 5.x. Will it work properly if I attempt to forward to 4.x indexers?

Re: Splunk Hadoop Connector: will it work with version 4.x indexers?

nfilippi_splunk — Fri, 18 Jan 2013 20:10:12 GMT

To import data from Hadoop HDFS into Splunk, you are correct, it does require Splunk 5.0 or later forwarder, which supports modular inputs.

For indexer/forwarder compatibility, I would refer to the following docs:
http://docs.splunk.com/Documentation/Splunk/5.0.1/Deploy/Enableareceiver#Compatibility_between_forwarders_and_indexers

Re: Splunk Hadoop Connector: will it work with version 4.x indexers?

the_wolverine — Wed, 23 Jan 2013 00:20:09 GMT

Based on this line of documentation, it looks like it is possible to use a 5.x forwarder to send to 4.2.x (and later) indexers.

These are the compatibility restrictions between versions of forwarders and indexers:

4.2+/5.0+ forwarders (universal/light/heavy) are backwards compatible down to 4.2+ indexers. For example, a 4.3 forwarder can send data to a 4.2 indexer but not to a 4.1 indexer.