Is it possible to send data from a 3.4 forwarder to a 4.2 indexer?

[arrowsmith3]

Have a DC with a heavy forwarder, 3.4 communicating with two indexes (1 running 3.4 the other running 4.2). We are having an issue receiving data on the 4.2 index server. The 3.4 is configured via the gui, we are trying to configure input/output via conf files for the 4.2 index.

3.4 continues to receive data however the 4.2 has not received any data for this particular DC. 4.2 index server is currently receiving data from other sources App/Linux/Windows however we are unable to receive data for these DC's. TCP port is open and indexer is responding to ping from the DC, index is configured, windows firewall is off, service has been restarted after changes are made, conf files are loaded in

C:\Program Files\Splunk\etc\system\local

Output:
[tcpout]
defaultGroup = server2_431
disabled = false
indexAndForward = 0

[tcpout:server2_431]
autoLB = true
server = server2.gov:431
sendCookedData = false

Input:
[default]
host = DC1

Monitor Windows event logs Events:

[WinEventLog:Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
evt_dc_name =
evt_dns_name =

[WinEventLog:Application]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
evt_dc_name =
evt_dns_name =

[WinEventLog:System]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
evt_dc_name =
evt_dns_name =

[tcp://9994]
queueSize=50KB
persistentQueueSize=100MB

Where are we going wrong? Is it possible to send data from a 3.4 forwarder to a 4.2 indexer? Can we have multiple index sources for this forwarder?

[araitz · Accepted solution]

See the following answer regarding forwarder compatibility:

http://splunk-base.splunk.com/answers/1528/what-is-the-forwarder-to-indexer-compatibility-matrix

I would recommend opening a support case, as some deeper digging is probably in order. One thing that jumps out is that 3.4 forwarder does not understand autoLB. If there are any errors in either splunkd.log, or if you can capture some packets on one end or the other, that might be useful as well.