5.0.7 forwarder won't connect to 5.0.1 indexer, why not?

[a212830]

Hi,

We upgraded a splunkforwarder to 5.7, sending to a 5.01 indexer, and now they won't connect. I thought the minor revs were compilable?

[piebob]

can you provide details about how they won't connect?

[yannK]

They are compatible.
Did you changed your configuration during the upgrade ?

[yannK]

Investigation steps :

• Check that the port is open with a telnet.
• use the SOS app to check if the indexer indexing queues are not blocked. then http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Troubleshootingeventsindexingdela...

If you have a support contract, you should open a case and attach a diag of the indexer and of the forwarder.

http://docs.splunk.com/Documentation/Splunk/5.0.1/Troubleshooting/Generateadiag

[a212830]

Thanks. Yeah, upgrading the indexers is a big deal. We are migrating towards 6.x with new hardware.

I'm getting a bunch of "can't connect" messages:

03-11-2014 13:45:56.078 -0400 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
O BatchReader - Continuing...
03-11-2014 13:46:43.104 -0400 INFO BatchReader - Could not send data to output queue (parsingQueue), retrying...
03-11-2014 13:46:44.102 -0400 INFO BatchReader - Continuing...

[yannK]

remark : as a good practice, you should not keep indexers on 5.0.1 but upgrade to the last 5.* at least.