Best way to upgrade of universal forwarders 6.1.2 to 8.1.x?

[Chiranjeev88]

Hi All,

We are planning an upgrade for our really old universal forwarders from 6.1.2 to 8.1.x and seems like now the documentation for these really old forwarders are not there .can someone guide as to how the upgrade process should go and the intermediate versions we need to upgrade to ?

I was thinking to directly install a new version of splunk UF (8.1.x)and shift my configs there and the fish bucket directory ,would that be a sane approach without re indexing anything ,or there are different things that need to be considered?.

[gcusello]

Hi @Chiranjeev88,

we're speaking about only Universal Forwarders, not Heavy, is it correct?

in this case in documentation it is hinted to pass for an intermediate 7.x version and an intermediate 8 version, before arriving to 9 version, as you can read at https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/HowtoupgradeSplunk#Upgrade_paths_to_... and https://docs.splunk.com/Documentation/Splunk/latest/Installation/HowtoupgradeSplunk#Upgrade_paths_to... .

It's obviously important that the final version of the UFs is equal or lower than the version of the Indexers or Intermediate HFs.

If you have HFs, you have to migrate them before starting with UFs.

Ciao.

Giuseppe