Deployment Architecture

Version Compatibility from Universal Forwarder to Heavy Forwarder

act_waltersj
Engager

I've seen a lot of documents and posts on compatibility between indexers (Idx) and forwarders, but nothing specific on universal forwarders (U-F) to heavy forwarders (H-F).  This is our current architecture with Splunk Enterprise versions:

U-F (6.5)  -->  H-F (7.3)  -->  Idx (7.3)

I need to upgrade to 8.1 Given that indexers can be a higher version than then forwarders, I can update the Idx and the H-F before the U-F's are all upgraded?  Or will the 6.5 vs 8.1 incompatibly affect U-Fs to H-Fs?  If it will, and I need to leave the H-F at 7.3 until the U-F are upgraded, can I have the U-Fs upgraded to 8.1,or will that not work because the U-F would be a higher version than the H-F?

The other option is to upgrade all of the U-F to 7.3, then upgrade them again after the Idx and H-F are upgraded, but I'm trying to avoid having the U-F upgrade done twice.  I also do not have a test or sandbox environment to do any kind of playing around on, so just trying it to see what happens isn't a good option.

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @act_waltersj,

for my experience, if you haven't metrics on UFs, the UFs 6.x continues to work with Idx 8.x and HFs 8.x.

Splunk doesn'r support this but it should work.

So I think that you can upgrade idx to 8.x, then HFs to 8.x and then UFs to 8.x, so you don't need to upgrade twice.

Ciao.

Giuseppe.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @act_waltersj,

for my experience, if you haven't metrics on UFs, the UFs 6.x continues to work with Idx 8.x and HFs 8.x.

Splunk doesn'r support this but it should work.

So I think that you can upgrade idx to 8.x, then HFs to 8.x and then UFs to 8.x, so you don't need to upgrade twice.

Ciao.

Giuseppe.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...