All Apps and Add-ons

Splunk stream forwarder versions?


We are running Splunk stream 6.5.1 on Splunk Enterprise 6.4.1 but most of our forwarders are still running on 5.0.5. I am planning to upgrade them later this year but I wanted to find out if Splunk stream can run on a forwarder of that version or not, I couldn't find anything on the web about the forwarder versions for the app.

Thanks, Mark.

0 Karma

Splunk Employee
Splunk Employee

Stream requirements will be contained on SplunkBase or in the App documentation:


Stream Documentation:

Splunk Enterprise version requirements
Splunk App for Stream runs on Splunk Enterprise. Before you install Splunk App for Stream, make sure that you are running the appropriate version of Splunk Enterprise.
Splunk App for Stream version 6.4.x and 6.5.0 require Splunk Enterprise version 6.3.0 or later.
For search head clustering, Splunk App for Stream version 6.5.0 requires Splunk Enterprise version 6.3.1 or later.
Independent deployment of the stream forwarder (streamfwd) 6.5.0 binary on a search head requires Splunk Enterprise version 6.3.1 or later.

Splunk Employee
Splunk Employee

Anything that supports modular inputs should work. I wouldn't go so far as to say we officially support forwarders that old, but I am aware of at least one customer that was successful doing this some time back. In Stream 6.5.1 on Linux, you also have the option of running the stream forwarder independently of the Splunk forwarder, so that may be worth consideration as well.