Upgrade Splunk Deployment

[malopez_riv]

Hi!

I´m looking for your help because I want to upgrade my Splunk deployment. Currently, I have all my forwarders running with the 6.2.3 version (my forwarders are running FreeBSD OS), my indexer and search head are running the 7.3 version (Those devices running in CentOS 11.2). The big question here,  can I update my indexer and search head device to the 8.1.0.1 and mantain my forwarders in the 6.2.3 version? will the forwarders send events to the indexer without problem?

I'm considering two scenarios for my upgrade:

Forwarders in version 6.2.3 -> Indexer in version 8.1.0.1 -> Search Head in version 8.1.0.1

or

Forwarders in version 6.2.3 -> Indexer in version 7.2.3 -> Search Head in version 8.1.0.1

What do you think guys?

I really appreciate any help that you can bring me!!

[richgalloway]

Can't do it.  Splunk 8.x doesn't support forwarders that old.  See https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwar...

You could keep the old indexers, but the 8.x search heads won't be able to take advantage of all of the new 8.x features.