Hi,
We upgraded a splunkforwarder to 5.7, sending to a 5.01 indexer, and now they won't connect. I thought the minor revs were compilable?
can you provide details about how they won't connect?
They are compatible.
Did you changed your configuration during the upgrade ?
Investigation steps :
If you have a support contract, you should open a case and attach a diag of the indexer and of the forwarder.
http://docs.splunk.com/Documentation/Splunk/5.0.1/Troubleshooting/Generateadiag
Thanks. Yeah, upgrading the indexers is a big deal. We are migrating towards 6.x with new hardware.
I'm getting a bunch of "can't connect" messages:
03-11-2014 13:45:56.078 -0400 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
O BatchReader - Continuing...
03-11-2014 13:46:43.104 -0400 INFO BatchReader - Could not send data to output queue (parsingQueue), retrying...
03-11-2014 13:46:44.102 -0400 INFO BatchReader - Continuing...
remark : as a good practice, you should not keep indexers on 5.0.1 but upgrade to the last 5.* at least.