Deployment Architecture

Upgrade Splunk Deployment

malopez_riv
New Member

Hi!

I´m looking for your help because I want to upgrade my Splunk deployment. Currently, I have all my forwarders running with the 6.2.3 version (my forwarders are running FreeBSD OS), my indexer and search head are running the 7.3 version (Those devices running in CentOS 11.2). The big question here,  can I update my indexer and search head device to the 8.1.0.1 and mantain my forwarders in the 6.2.3 version? will the forwarders send events to the indexer without problem?

I'm considering two scenarios for my upgrade:

Forwarders in version 6.2.3 -> Indexer in version 8.1.0.1 -> Search Head in version 8.1.0.1

or

Forwarders in version 6.2.3 -> Indexer in version 7.2.3 -> Search Head in version 8.1.0.1

 

What do you think guys?

 

I really appreciate any help that you can bring me!!

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can't do it.  Splunk 8.x doesn't support forwarders that old.  See https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwar...

You could keep the old indexers, but the 8.x search heads won't be able to take advantage of all of the new 8.x features.  

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...