Backward compatible, Indexer 6.1.2 to Universal Forwarder 4.3.4?

[widjoyoh]

Please advise if the Universal forwarder v4.3.4 still works fine* when upgrading Indexer from v4.3.4 to v6.1.2.
Works fine as in:
1. still can send logs to Indexer, and it is processing fine
2. the deployment server still can communicate fine with the universal forwarder for updating the list of logs to be collected

Thank you

[MarioM · Accepted solution]

Looking at the latest forwarder matrix in http://docs.splunk.com/Documentation/Splunk/6.1.2/Forwarding/Compatibilitybetweenforwardersandindexe...

It states

6.x indexers are backwards compatible with forwarders down to 5.0.x.

If we look at an old Splunk Answer from 2013 http://answers.splunk.com/answers/119729/what-is-the-correct-upgrade-order-forwarders-first-or-last

It states

6.x indexers are backwards compatible with forwarders down to 4.x.

[gkanapathy]

It technically will probably work fine. However, 4.x forwarders are no longer supported by Splunk. At the time of release of 6.0 (a year ago), there was a grace period where version 4.x software was still supported, but that grace period has expired. Therefore there is no guarantee that it will work and if it does not, your recourse will be to upgrade the forwarder.