upgrade splunk forwarder

[watzson]

Hi there, i am upgrading my splunk server to version 6. however, i have multiple splunk forwarders (abt 300) in different versions, from v4.x to v6.

i know other has asked something similar before. if i am going to choose one version, which one will it be ?

thanks in advance.

[gfuente · Accepted solution]

Hello

You should upgrade at least to version 5.x

6.x indexers are backwards compatible with forwarders down to 5.0.x.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Compatibilitybetweenforwardersandindexe...

And, as a best practice you should have them in 6.x

As a best practice, it is recommended that indexers be at the same or higher version level than the forwarders they're receiving data from.

Regards