I've seen a lot of documents and posts on compatibility between indexers (Idx) and forwarders, but nothing specific on universal forwarders (U-F) to heavy forwarders (H-F). This is our current architecture with Splunk Enterprise versions:
U-F (6.5) --> H-F (7.3) --> Idx (7.3)
I need to upgrade to 8.1 Given that indexers can be a higher version than then forwarders, I can update the Idx and the H-F before the U-F's are all upgraded? Or will the 6.5 vs 8.1 incompatibly affect U-Fs to H-Fs? If it will, and I need to leave the H-F at 7.3 until the U-F are upgraded, can I have the U-Fs upgraded to 8.1,or will that not work because the U-F would be a higher version than the H-F?
The other option is to upgrade all of the U-F to 7.3, then upgrade them again after the Idx and H-F are upgraded, but I'm trying to avoid having the U-F upgrade done twice. I also do not have a test or sandbox environment to do any kind of playing around on, so just trying it to see what happens isn't a good option.
