Experience with different Universal Forwarder versions

patrickvanreck — Wed, 08 Sep 2021 10:55:33 GMT

Hi everybody

I have a couple of questions regarding the compatibility between Splunk Enterprise Server and Universal Forwarders.
This is mainly about the Mac OSX clients, which as everyone knows are always installed with the last OSX when ordering.
Our servers are still on Enterprise Release 8.0.9, but we can't install that version on the Mac OSX 11 clients.

According to Splunk, Universal Forwarder 8.0.9 is not in the compatibility list of OSX 11 clients (only OSX 10.13, 10.14, 10.15). That means you have to install the 8.2.x version. From then on the OSX 11 appears as compatible.

This means that the Universal Forwarder has a higher version installed than the server.However, based on the compatibility list from Splunk (https://docs.splunk.com/Documentation/Forwarder/8.0.9/Forwarder/Compatibilitybetweenforwardersandindexers), compatibility would be given.

Can we install Universal Forwarder 8.0.9 on OSX-11 clients without having problems?
Or can we install the Universal Forwarder 8.2.1 on the OSX-11 clients without having problems with our Enterprise servers which are still on version 8.0.9?

Many thanks for your hint's

Re: Experience with different Universal Forwarder versions

PickleRick — Wed, 08 Sep 2021 11:33:32 GMT

As you can see from the table, 8.2.x forwarders should (according to splunk) work with 8.0.x indexers. So I don't see a problem here.

topic Re: Experience with different Universal Forwarder versions in Installation

Experience with different Universal Forwarder versions

Re: Experience with different Universal Forwarder versions